Cílem práce je navržení a implementace řízení přístupu na základě URI požadovaného zdroje. Pro implementaci bylo jako základ použito rozšíření Host Based Access Control v nástroji pro správu identit FreeIPA. Zároveň bylo třeba rozšířit související infrastrukturu, především program SSSD. Jako příklad aplikace využívající HBAC na základě URI byl implementován autorizační modul pro Apache HTTP Server. Zásadním řešeným problémem byl návrh infrastruktury pro komunikaci nezbytných parametrů a návrh strategie vyhodnocení HBAC pravidel definujících přístupová práva. Kompletní řešení bylo předvedeno na příkladu zabezpečení instance webové aplikace Wordpress.

Social Web of Things (SWoT) is a user centric framework which facilitates interaction between software agents deployed on smart things and in the cloud. Software agents deployed on smart things are remotely accessible, host sensitive resources, and often represent high value targets. SWoT currently does not feature adequate security mechanisms which could protect software agents from unauthorized access. In this thesis, we aim to rectify this deficiency by introducing platform independent, exible, and user centric authorization mechanism inSWoT. We derive requirements and design of abstract authorization architecture from the preceding seminal work performed in SENSEI project. SENSEI and SWoT share same problem domain, but while SENSEI addresses enterprise use cases SWoT focusses on consumer use cases. This single but fundamental difference motivates adaptations of SENSEI contributions for application in SWoT. To realize concrete authorization architecture we perform extensive study of various authorization solutions. Results of our study indicate that novel User Managed Access (UMA) protocol represents promising solution for SWoT. We present the Authorization as a Service solution for SWoT framework, based on UMA protocol. This solution enables users to manage and control communication between software agents deployed on smart things and in the cloud from single centralized location. It also features runtime association of software agents, management, evaluation, and enforcement of access permissions for resources provided by software agents. / "Social Web of Things" (SWOT) är en användarcentrerad ram som underlättar samverkan mellan agenter som körs på smarta saker och i molnet. Agenter som körs på smarta saker är fjärråtkomst, värd känsliga resurser, och ofta utgör högt värde mål. För närvarande SWOT ramverket omfattar inte lämpliga säkerhetsmekanismer som skulle kunna skydda dessa agenter från obehörig åtkomst. I denna uppsats vill vi rätta till detta brist genom att införa plattformsoberoende, flexibel och användarvänlig centrerad auktorisation mekanism i SWOT ramen. Vi härleda krav och design av abstrakt tillstånd arkitektur från föregående sädes-arbete som utförs i ett SENSEI projektet. SENSEI och SWOT delar samma problem domän, men samtidigt SENSEI behandlar ärenden företagsbruk SWOT fokuserar på konsumenten användningsfall. Denna singel men grundläggande skillnaden motiverar anpassningar av SENSEI avgifter för ansökan i SWOT. Till realisera konkreta tillstånd arkitektur vi utför ett omfattande studie av olika lösningar för tillstånd. Resultat av vår studie tyder på att en ny användarhanterad tillgång (UMA) Protokollet utgör lovande lösning för SWOT. Vi presenterar tillståndet som en service lösning för SWOT ramverk, baserat på UMA-protokollet. Denna lösning gör det möjligt för användare att hantera och kontrollera kommunikationen mellan agenter utplacerade på smarta saker och i molnet från enstaka centraliserad plats. Dessutom gör vår lösning dynamisk sammanslutning av agenter, ledning, utvärdering och tillsyn av tillträde behörigheter för resurser som tillhandahålls av agenter.

This diploma thesis deals with authentication using RADIUS protocol and authentication methods in accordance with standard IEEE 802.1X. At the beginning there are shortly characteristics of chosen authentication methods, such as CHAP, PAP and some EAP types. Document includes summary of RADIUS protocols implementations, especially the FreeRADIUS server. Our goal is to implement a management tool to adminitrate FreeRADIUS server.

Denna examensuppsats ämnade att teoretiskt undersöka offentliga dokument bakom införandet av hälso-och sjukvårdskuratorslegitimationen. För att besvara syftet utgick studien från frågeställningarna: Hur motiveras införandet av hälso-och sjukvårdskuratorslegitimation? Hur skulle motiveringarna kunna inverka på kuratorer inom hälso-och sjukvården som profession? Datamaterialet bestod av Socialstyrelsens rapport från 2014, samt propositionen 2017/18:138, vilka låg till grund för riksdagsbeslut om införande av hälso-och sjukvårdskuratorslegitimation. Dokumenten analyserades med tematisk analys för att synliggöra mönster i motiveringarna bakom införandet. Resultatet analyserades utifrån de professionsteoretiska begreppen professionalism och legitimation. Analysen av resultatet visar att legitimation är ett sätt att stärka kuratorers auktoritet i en kontext som domineras av ett biomedicinskt perspektiv. Däremot är legitimationens främsta syfte att stärka patientsäkerheten genom statlig kontroll i form av specialiserad vidareutbildning och möjligheter till tillsyn av professionen. Eftersom legitimationen inte skyddar legitimerade hälso-och sjukvårdskuratorers arbetsuppgifter sker ingen stängning av yrket. Legitimationen får snarare en funktion som en eftersträvansvärd yrkesidentitet för professionen, denna strävan bidrar till att yrkesverksamma och arbetsgivare agerar utefter legitimationens riktlinjer. Därmed sker en indirekt styrning av professionen genom införande av legitimation, där rädslan för att förlora legitimationen kan ha en negativ inverkan på interaktionen mellan patienter och hälso-och sjukvårskuratorer. / The aim of this study was to do a theoretical analysis of official documents behind the introduction of licensure for healthcare counselors. To answer the purpose, the study was based on the following questions: How was the introduction of health care counselor’s licensure justified? How might the motivations affect counselors in health care as a profession?The selection of documents that were analysed consisted of the National Board of Health and Welfare's investigation into the introduction of identification from 2014, as well as the bill 2017/18:138 which was the basis for the actual decision the Swedish parliament made on the introduction of licensure. The documents were analysed using a thematic analysis to map the arguments for the inclusion of licensure for healthcare counselors. The empirical evidence was then analysed based on the professional theoretical concepts of professionalism and legitimation.The result was analysed based on the theoretical concepts of professionalism and legitimation. The analysis of the results shows that licensure is a way to strengthen healthcare counselors’ authority in a context that is dominated by a biomedical perspective. On the other hand, the main purpose of the licensure is to strengthen patient safety through governmental control by specialized tertiary education and supervision of the profession. Since the license does not protect the work tasks of healthcare counselors, no occupational closure of the profession has been made. Instead, the licensure functions as an aspirational professional identity for the profession, this aspiration contributes to professionals and employers acting according to the guidelines of the licensure. Thereby, an indirect control of the profession takes place through the introduction of licensure, where the fear of losing the licensure might have a negative impact on the interaction between patients and healthcare counselors.

Industrial Control Systems (ICSs) play a critical role in various industries, automating processes and efficiency optimization. However, these systems have security vulnerabilities that make them prone to cyber attacks, so it is crucial to have strong access control mechanisms in place. This master thesis focuses on the investigation, development, and evaluation of workflow-driven dynamic authorization for modular automation systems. The authorization enables specifying of policies that can adapt in real-time to the dynamic security environment of ICSs. Furthermore, the thesisexplores the efficiency of authorization in terms of execution time, memory consumption, andtoken size through experimental evaluation. The experimental evaluation compares three variationsof token population: a baseline approach that directly encodes accesscontrol list permissions into the token, and two token population algorithms that aim to reduce thetoken size by replacing permissions with overlapping roles. The results show that the baseline approach achieves the shortest execution time and lowest memory consumption, but leads to increased token sizes. On the other hand, the token population algorithms reduce the token size at the costof increased execution time and memory consumption. The choice between these approaches wouldinvolve trade-offs and would depend on the specific requirements of the ICSs environment. / InSecTT

Computer Aided Design (CAD) applications have historically been based on a single user per application architecture. Although this architecture is still popular to date, it does have several drawbacks. First of all the single user CAD architecture inhibits a concurrent engineering design process where several designers can work on the same model simultaneously. This limitation introduces time inefficiency especially when a project involves geographically dispersed designers. A solution to these drawbacks could be a transition from the traditional single user CAD architecture to a multiuser collaborative architecture. Advances in computer networking technologies, especially relating to the Internet, have provided the needed tools to make this transition a reality, thus making it possible for designers to simultaneously work on geometric models from one or more networked computers regardless of the location of the user. This new paradigm is expected to improve collaboration and greatly reduce product design times and consequently reduce cost and improve productivity. The multi-user architecture will, however, also require reliable security mechanisms to ensure its successful deployment in an enterprise environment where protection of intellectual property is of critical importance. This thesis proposes a framework to implement authentication, authorization and secure data communications in a multiuser collaborative CAD software system. This framework has been tested on an emerging multiuser collaborative CAD system called v-CAx being developed at Brigham Young University.

Kompetensområdet sjuksköterskans arbetsledning av omvårdnadsarbetet är ett tämligen outforskat ämne. Mer kunskap om läkare- och undersköterskors syn på vad som innefattas i sjuksköterskans arbetsledning skulle kunna bidra till ett bättre samarbete som på sikt kan gynna omvårdnadsarbetets utveckling och därigenom även patienten. Syftet med studien är att få ökad kunskap om läkare och underskö-terskors syn på vad som innefattas i kompetensområdet sjuksköterskans arbets-ledning av omvårdnadsarbetet. Metoden som användes var en empirisk intervju-undersökning där urvalet bestod utav fyra läkare och fyra undersköterskor. Mate-rialet analyserades med innehållsanalys, inspirerad av Burnard (1991). Resultatet utmynnade i följande huvudkategorier: Överblick, samarbete och yttersta om-vårdnadsansvaret. Resultatet visade att det som informanterna ansåg innefattas i sjuksköterskans kompetensområde arbetsledning av omvårdnadsarbetet i stor ut-sträckning stämde överens med uppgifter som benämns under huvudområdet ar-betsledning i Socialstyrelsens kompetensbeskrivning för legitimerad sjuksköterska (2005) men att rollen som arbetsledare av omvårdnadsarbetet inte var självklar och erkänd av alla informanterna. / Leadership in nursing is a relatively unexplored area of research. Further knowl-edge about doctors and staff nurses’ views on what is included in this area could gain development in nursing and thereby the qualities of patient care. The aim of this study is to gain further knowledge about doctors and assistant nurses’ views on what is included in the area of leadership in nursing. The method used was semi-structured interview. The selection of informants was four doctors and four assistant nurses. The analysis method was thematic content analysis inspired by Burnard (1991). The analysis resulted in the following main categories: General view, ability of cooperation and main responsibility. The result showed that doc-tors- and assistant nurses' views on what was included in the area of leadership in nursing to a large extent was congruent to job assignments written in The National Board of Health and Welfare’s competence description for registered nurses. However, the leadership role of nursing was not obvious and acknowledged by all the informants.

Stora mängder data genereras dagligen av slutanvändare hos olika tjänster. Denna data tenderar att tillhandahållas av olika aktörer, vilket skapar en fragmenterad marknad där slutanvändare måste nyttja flera programvaror för att ta del av all sin data. Detta kan motverkas genom utvecklandet av aggregeringstjänster vilka samlar data från flera tjänster på en enskild ändpunkt. Utveckling av denna typ av tjänster riskerar dock att bli kostsamt och tidskrävande, då ny kod skrivs för flera projekt trots att stora delar av funktionaliteten är snarlik. För att undvika detta kan etablerade tekniker och ramverk användas för att på så vis återanvända mer generella komponenter. Vilka av dessa tekniker som är bäst lämpade och således kan anses vara mest effektiva ur ett utvecklingsperspektiv, kan dock vara svårt att avgöra. Därför baseras denna uppsats på vad som genom analys av akademisk litteratur kan utläsas som ett akademiskt konsensus.Innan denna uppsats påbörjades utvecklades en Java-baserad dataaggeringstjänst baserad på krav från ÅF i Malmö. Denna experimentella implementation har som syfte att samla in data från två separata tjänster, och tillgängliggöra denna på en enskild ändpunkt. Efter att implementationen färdigställts påbörjades arbetet på uppsatsen. Denna består av en litteraturstudie för att undersöka vilka tekniker och ramverk som akademisk forskning funnit bäst lämpad för användningsområdet. Vidare används resultaten från studien även för att analysera i vilken grad dessa korrelerar med de krav som ÅF presenterade inför den experimentella implementationen.Litteraturstudien visar på att de teknikmässiga val som gjordes av företaget i stor utsträckning korrelerar med de tekniker som akademisk forskning funnit bäst lämpade för användningsområdet. Detta innefattar bland annat OAuth 2.0 för autentisering, JSON som serialiseringsformat samt REST som kommunikationsarkitektur. Vidare visar denna litteraturstudie på en eventuell lucka inom den tillgängliga litteraturen, då sökningar kring specifika programvaror relaterade till området endast resulterar i en mindre mängd artiklar. / Large quantities of data are generated daily by the end users of various services. This data is often provided by different providers, which creates a fragmented market where the end users have to utilize multiple applications in order to access all of their data. This can be counteracted by the development of aggregation services that gather data from multiple services to a combined endpoint. The development of these kinds of services does however run the risk of becoming costly and time-consuming since new code is written for several projects even though large portions of the functionality is similar. To avoid this, established technologies and frameworks can be utilized, thereby reusing the more general components. Which of the technologies are the best suited, and thereby can be considered the most effective from a development perspective, can however be difficult to determine. This essay is therefore based on what can be considered an academic consensus through analysis of literature regarding earlier reasearch on the subject. Before the writing of the essay began a Java-based data aggregation service was developed, based on requirements from the company ÅF in Malmö. The purpose of this experimental implementation is to gather data from two separate services, and make them accessible on a unified endpoint.After the implementation was finished, work on the essay began. This consists of a literature review to investigate what technologies and frameworks that has been found best suited for this area of application by academic research. The results from this study are also used to analyze the extent of the correlation between the results and the requirements presented by ÅF regarding the experimental implementation. The literature review shows that the choices made by the company largely correlates with the technologies that the academic research has found best suited for this area of application. This includes OAuth 2.0 for authentication, JSON as a serialization format and REST for communications architecture. The literature review also indicates a possible gap within the available academic literature since searches regarding specific pieces of software related to the subject only results in a small amount of articles.

Säkerhet i applikationer blir allt viktigare, ju mer allting i samhället blir digitaliserat, för attskydda användare och information. Bara under genomförandet av denna rapport skedde två större informationsläckor av känsliga svenska informationshemligheter. Målsättningen med dennarapport är att ta reda på vad det är för säkerhetsrisker som finns för applikationer, generellaåtgärder som kan implementeras för att åtgärda dessa risker och hur dataskyddsförordningen(GDPR) hör ihop med säkerheten i webbapplikationer. För att komma fram till generella åtgärder gjordes även en säkerhetsutvärderingsmetod som används för att kunna utvärdera hurde olika åtgärderna skyddar applikationer för att dels kunna se att alla delar säkrats samt attde fungerar som de bör. Resultatet av denna rapport ger generell åtgärdslista med åtgärder sombör implementeras i applikationers backend men för att ge en liknande åtgärdslista för frontendkrävs det mer arbete, där frontend åtgärdslistan i denna rapport är minimalistisk. Säkerhets utvärderingsmetoden visade sig även bli en del i de åtgärdslistor för att kunna användas även pådriftsatta applikationer. I resultatet av GDPR-undersökningen framkom det att inga specifikakrav ställs ifrån GDPR, istället har lagen i uppgift att höja prioriteten genom att konsekvenserna som kan uppkomma vid felhantering av användares personuppgifter blir mer påtagliga /kostsamma för organisationen. / Security in applications, to protect users and information, is becoming increasingly importantas society is becoming more digitized. During the duration of this report two major informationleaks, of sensitive Swedish classified information, occurred. The aim of this report is to findwhat security risks exist for webapplications, general measures that can be implemented to address these risks and how The General Data Protection Regulation (GDPR) is related to securityin applications. In order to achieve these general measures a security evaluation method was alsoused to be able to evaluate how the various measures protect webapplications, and function asrequired. The results of this report provide a general list of actions that should be implementedin application backends, but to provide a similar for the frontend more wokrs is required, wherethe frontend action list in this report is minimal. The safety evaluation method also proved to bea part of the action lists in order to be able to test the security even on operational applications.The results of the GDPR survey showed that no specific requirements are set from GDPR,instead the law has the task of raising the priority by making the consequences that can arisefrom incorrect handling of users’ personal data more serious / costly to the organization

Introduction: The volume of antipsychotic medications prescribed to children and adolescents has risen sharply since second generation antipsychotics, also referred to as atypical antipsychotics, were introduced in the 1990’s. The concern surrounding the expanded use of antipsychotics was that the medications have significant adverse metabolic side effects and they were often prescribed to treat conditions in young children for which they have not been proven to be safe and effective. While it is not unlawful for health care providers to prescribe medications for uses beyond which they have been approved by the United States Food and Drug Administration, the lack of empirical evidence guiding much of the antipsychotic use in children had professional pediatric medical groups and policy makers concerned for the well-being of children receiving the medications. Several states, including Pennsylvania, enacted prior authorization policies in an attempt to restrict prescribing to children where a medical need has been established. However, the impact of the policies is largely unknown since published data on the topic is sparse. Methods: This retrospective, medical claims-based cohort study, used de-identified administrative Medicaid data from January 2008 to December 2010 to investigate the impact of Pennsylvania’s September 2008 antipsychotic prior authorization policy on antipsychotic prescribing prevalence in children targeted by the policy. Descriptive methods and segmented regression of the interrupted time series were used to assess the effects of the policy on monthly antipsychotic prescribing prevalence. A difference-in-difference analysis compared Pennsylvania’s prescribing to Ohio, a geographically proximate and demographically similar state without a prior authorization policy; and Delaware, a state that enacted a policy 3 years prior to Pennsylvania. The potential for compensatory prescribing was assessed by reporting the prevalence of other psychotropic medications over the study period. Results: An average of 99,074 Pennsylvania Medicaid enrollees ages 0-6 were identified as meeting the study criteria annually from 2008-10. Immediately following the policy intervention, an abrupt, significant reduction in monthly prescriptions of antipsychotics was observed (-51 prescriptions per 100,000; p=0.0052) and sustained over the observation period. The proportion of children filling prescriptions for antipsychotics dropped approximately 46% and the average number of antipsychotic prescriptions filled per month was reduced by 53% in 2010 compared to 2008. In Ohio, a state without such a policy, the proportion of children receiving an antipsychotic increased nearly 10% in 2010 compared to 2008 and the average number of monthly prescriptions increased 30%. Reductions in antipsychotic prescribing in Delaware, a state that had its antipsychotic policy in place since 2005, were comparable to Pennsylvania. There was no evidence that non-antipsychotic psychotropic medications were prescribed in place of the medications restricted by the policy. Conclusions: Pennsylvania’s 2008 prior authorization policy was associated with a significant decrease in annual and monthly antipsychotic prescribing prevalence in Medicaid-insured children targeted by the policy, those ages 0-6 years of age. Reductions in most other psychotropics was also observed, indicating changes in prescribing behavior may have extended beyond antipsychotics. While this analysis suggests the policy may have achieved its primary aim of reducing antipsychotic prescribing, more research is needed to better understand the complex array of factors influencing provider behavior and to explore potential unintended consequences of the policy. / Public Health