>Magister Scientiae - MSc / The recent years have seen an increase in the number of users accessing online services using communication devices such as computers, mobile phones and cards based credentials such as credit cards. This has prompted most governments and business organizations to change the way they do business and manage their identity information. The coming of the online services has however made most Internet users vulnerable to identity fraud and theft. This has resulted in a subsequent increase in the number of reported cases of identity theft and fraud, which is on the increase and costing the global industry excessive amounts. Today with more powerful and effective technologies such as artificial intelligence, wireless communication, mobile storage devices and biometrics, it should be possible to come up with a more effective multi-modal authentication system to help reduce the cases of identity fraud and theft. A multi-modal digital identity management system is proposed as a solution for managing digital identity information in an effort to reduce the cases of identity fraud and theft seen on most online services today. The proposed system thus uses technologies such as artificial intelligence and biometrics on the current unsecured networks to maintain the security and privacy of users and service providers in a transparent, reliable and efficient way. In order to be authenticated in the proposed multi-modal authentication system, a user is required to submit more than one credential attribute. An artificial intelligent technology is used to implement a technique of information fusion to combine the user’s credential attributes for optimum recognition. The information fusion engine is then used to implement the required multi-modal authentication system.

A possibilidade da substituição de órgãos e tecidos que estão comprometidos por outros que estão com suas funções vitais adequadas para o corpo humano, acontece por um principal objetivo, preservar a saúde do homem buscando maior sobrevida e principalmente proporcionando melhor qualidade de vida. O trabalho aborda o assunto doação de órgãos, onde será explorado o tema relacionando à percepção da família sobre morte encefálica e os impedimentos para a doação, tendo como principal objetivo conhecer as principais dificuldades e fatores que impedem os familiares de pacientes com morte encefálica autorizarem a doação de órgãos. Foram analisados 66 prontuários de prováveis doadores (pacientes com Morte encefálica), sendo 36 prontuários do ano de 2010 e 30 prontuários do ano de 2011. No entanto dos 66 prováveis doadores, foram doados os órgãos de apenas 16 pacientes, dos demais prováveis doadores (50 pacientes) não aconteceram as doações, houve recusa por parte da família, 46% alegaram que não tiveram informações sobre o que estava acontecendo, que houve pouco diálogo dos profissionais com a família e que principalmente o atendimento inicial na emergência não teve humanização. São muitas dúvidas que acometem as famílias em todo o processo, referente à morte encefálica, a liberação do corpo e outros questionamentos que surgem, porém quando os familiares são esclarecidos e informados pela equipe de saúde gera uma satisfação quanto ao atendimento prestado durante o período de internação do paciente, proporcionando assim um conforto às famílias e, consequentemente, auxiliando na diminuição da dor e do sofrimento. / The possibility of substituting organs and tissues which are damaged with others which have their vital functions working adequately for the human body, takes place for one main reason, to preserve the health of the person seeking a longer life and mainly to propitiate a better quality of life. This paper deals with the subject of organ donation, where the theme will be explored relating it to the family‟s perception of brain death and the impediments for donation, having as its main goal to get to know the main difficulties and factors which impede relatives of brain dead patients to authorize organ donation. 66 patient records of probable donors (brain dead patients) were analyzed, 36 of which were from the year 2010 and 30 from the year 2011. However, of the 66 likely donors, organs of only 16 patients were donated. There were no donations from the other probable donors (50 patients). The families refused. 46% alleged that they did not have information about what was happening, that there was little dialog of the professionals with the family and mainly, that the initial service in the emergency room was not humanized. Many doubts afflict the families in the whole process with regard to brain death, to liberating the body and other questions which arise. If the health team clarifies and informs the family adequately there will be greater satisfaction with regard to the service rendered during the patient‟s period of internment, propitiating comfort for the families and consequently helping to diminish the pain and suffering.

Port-knocking is a security mechanism used in computer systems to hide available network services. Its operation relies on a drop policy firewall setting in order to make impossible for port-scanning attacks to occur. This project researches the impact of implementing such a software solution. Furthermore, it looks into the behavior of three chosen implementations and make conclusions on the benefits and disadvantages that they bring. In addition, the surrounding implications related to both user and administrator are explored. This thesis includes tests on the resource consumption of the implementations as well as records of the added delay of using the mechanism when initiating a SSH session. There has not been such research performed in this field and the results of it could be beneficial to those who are involved in computer science and network security in particular. Finally, the product of this study state that port-knocking is overlooked and has great benefits in preventing zero-day exploits and hacker tools relying on exposed network services.

Ericsson develops and builds mobile telecommunication networks. These networks consists of a large number of equipment. Each telecommunication company has a staff of administrators appointed to manage respective networks. In this thesis, we investigate the requirements for an access control model to manage the large number of permissions and equipment in telecommunication networks. Moreover, we show that the existing models do not satisfy the identified requirements. Therefore, we propose a novel RBAC model which is adapted for these conditions. We also investigate some of the most common used commercial tools for administrating RBAC, and evaluate their effectiveness in coping with our new proposed model. However, we find the existing tools limited, and thereby design and partly implement a RBAC managing system which is better suited to the requirements posed by our new model.

Le nombre de véhicules électriques (VEs) augmente de plus en plus depuis des dernières années. De ce fait, des problèmes d’attente dans les stations de recharge apparaissent, vu leur nombre limité dû aux coûts élevés d’installation. En outre, il y a des problèmes liés d'une part à l’autonomie due à la capacité limitée des batteries et des problèmes liés d'autre part à la crainte d’avoir une portée insuffisante pour atteindre une destination du véhicule ou de tomber en rupture d’énergie entre un point de départ et un point de destination. Faire de la planification de recharge et diriger les conducteurs vers des stations de recharge disponibles pendant leur trajet pourraient contribuer à résoudre ces deux problèmes. Pour ce faire, une communication bidirectionnelle entre les VEs et la grille serait utile. C’est dans ce cadre, que ce projet est proposé. D’une part, dans ce projet, on propose une architecture sécurisée où les VEs et la grille intelligente peuvent échanger les données pour effectuer une réservation des créneaux horaires dans les stations de recharge et planifier les itinéraires. Une étape d’authentification et d’autorisation du véhicule ou de l’usager est primordiale pour garantir la sécurisation des échanges et la confidentialité des données des VEs. Cela implique une demande de fournir des informations en mode crypté à travers les protocoles de sécurisation. Cette étape d’authentification et d’autorisation est établie après une étape de notification du VE. D’autre part, on met en place un nouveau schéma pour planifier les itinéraires des VEs. Ce schéma prend en compte l’état de charge du véhicule, son origine, sa destination et les stations de recharge disponibles sur la route. Le schéma établit la réservation dans les stations selon des mécanismes d’optimisation de temps d’attente du VE dans les stations de recharge et de sa consommation d’énergie globale durant son voyage depuis le point d’origine jusqu’à la destination voulue. / Abstract : The number of electric vehicles (EVs) has increased significantly in recent years. Owing to the limited number of charging stations (CSs), the waiting time in charging stations has swelled. In addition, the limited capacity of EV batteries can evoke the drivers’ range-anxiety, defined as the fear of having insufficient range to reach a destination. Make a charging planning and directing the drivers to the available charging stations during their journey could help to solve these problems. To do this, a bidirectional communication between the EVs and the smart grid would be useful. It is within this framework that this project is proposed. In this project, we propose a secure architecture where EVs and the smart grid can exchange data information for making slots reservation at the charging stations and route planning. Authentication and authorization of EVs or users is essential to guarantee EVs confidentiality and the exchange of information. This implies a request to provide the sensitive information in encrypted mode through security protocols. These procedures are executed after the EV notification process. Besides, we propose a new scheme for planning EVs itineraries. This scheme considers the state of charge of EVs, their starting positions, their destinations and the charging stations available on the road. The system establishes the reservation of the charging slots via optimizing the waiting time at charging stations as well as the energy consumption during EVs journey, from their starting positions to their designated destinations.

O surgimento e a popularização de arquiteturas de software que fornecem suporte à programação distribuída orientada a objetos, como CORBA, .NET e Java EE, gerou uma demanda por infra-estruturas de segurança eficientes, capazes de proteger os recursos dos sistemas de ataques maliciosos. Essa proteção começa pela identificação dos usuários que interagem com os sistemas, processo conhecido como autenticação. Entretanto, a autenticação por si só não é suficiente para garantir a segurança dos recursos, uma vez que a autenticação não determina quais ações os usuários estão autorizados a executar depois de autenticados. Em outras palavras, um mecanismo de autorização, que faz valer as políticas de controle de acesso aos recursos definidas pelos administradores de sistemas, se faz necessário. Neste trabalho estudamos mecanismos de controle de acesso baseado em papéis e a aplicabilidade dos certificados de atributos X.509 como estrutura de armazenamento desses papéis em um ambiente Java EE. Em particular, estendemos a infra-estrutura de segurança do servidor de aplicações JBoss, de modo que ela passasse a comportar os certificados de atributos X.509. Além disso, analisamos as vantagens e desvantagens do uso de tais certificados e avaliamos o desempenho da extensão desenvolvida em relação a outras alternativas que são oferecidas pelo JBoss para o armazenamento de papéis dos usuários. / The popularization of software architectures that provide support for distributed object-oriented programming, like CORBA, .NET, and Java EE, revealed the need for efficient security infrastructures to protect the resources of enterprise systems from malicious attacks. This protection usually begins with the identification of the users that interact with the systems, a process known as authentication. However, authentication alone is not enough to guarantee the protection of the resources, as it cannot determine what actions a particular user is allowed to execute on a given resource. In other words, an authorization mechanism is needed in order to enforce the access control policies as defined by the system administrators. In this dissertation we studied role-based access control mechanisms and the use of X.509 attribute certificates as data structures that store the users roles in a Java EE environment. Particularly, we added X.509 attribute certificates support to the existing JBoss application server security infrastructure. Furthermore, we evaluated the pros and cons of using these certificates, and compared the performance of the developed extension to the performance of the existing solutions provided by JBoss to store the users roles.

The solutions presented in this dissertation describe a new paradigm in which we shepherd these network security protocols through atmosphere transitions, offering new ways to analyze and monitor the state of the protocol. The approach involves identifying a protocols transitional weaknesses through adaption of formal models, measuring the weakness as it exists in the wild by statically analyzing applications, and show how to use network traffic analysis to monitor protocol implementations going into the future. Throughout the effort, we follow the popular Open Authorization protocol in its attempts to apply its web-based roots to a mobile atmosphere. To pinpoint protocol deficiencies, we first adapt a well regarded formal analysis and show it insufficient in the characterization of mobile applications, tying its transitional weaknesses to implementation issues and delivering a reanalysis of the proof. We then measure the prevalence of this weakness by statically analyzing over 11,000 Android applications. While looking through source code, we develop new methods to find sensitive protocol information, overcome hurdles like obfuscation, and provide interfaces for later modeling, all while achieving a false positive rate of below 10 percent. We then use network analysis to detect and verify application implementations. By collecting network traffic from Android applications that use OAuth, we produce a set of metrics that when fed into machine learning classifiers, can identify if the OAuth implementation is correct. The challenges include encrypted network communication, heterogeneous device types, and the labeling of training data.

Master`s thesis is based on the assignment of company Honeywell to create integral system for saving and management of development documentation. Designed system will introduce data warehouse with transparent display of documents being connected with development of customer’s requirements, products and tests, test runs. Solution consists of two parts: A – Requirements and Products and B – Tests, Test runs and Person, whereas Master`s thesis deals with the part B. For system creation utilities of following programming languages were used HTML, PHP, JavaScript and database system MySQL. In the first phase was designed database structure (tables and relations between them). Except that was designed structure for authorization algorithm and integral concept of whole application was created. The second phase is realization. At first are created supporting algorithms. It is servicing database by functions, uniform displaying results from database and authorized access of users to the application. Further data library for integral display data forms, based on used template system Smarty and other libraries, f.e. attribution of the files to records in SQL tables. Important part was implementation of designed database system and related programs. In Tests and Test runs there is user interface established and individual relations between them. According to assignment all fundamental programs were designed together with support instruments. Individual source files are saved in transparent structure of folders, so this structure is possible to apply on any computer, where are installed programs to web hosting. The result of Master`s thesis is then integrated progress report together with functional source codes.

The diploma thesis is concerned with solving security problems in local computer networks. The main part deals with the solution of authorization of wireless clients against the RADIUS server and with the proposal of domain controller using open-source products and the tools of operating system GNU/Linux.

The thesis focuses to define the concept of selected activities in construction and further entities which are allowed to conduct the activities in construction and what qualification is needed for them and what is their range of responsibility. The thesis is divided on two parts. The theoretical part deals to define the basic concepts, which origins in law. The practical part contains exact example on which are, used activities of authorized persons, their duties during the activities in construction and their responsibility. The essential part of the thesis are the proposals and recommendations, which could open the discussion for some future changes leading to more effective achievement in selected activities in construction.