Cette thèse s’intéresse aux effets des attaques par fautes physiques sur le code d’un système embarqué en particulier la carte à puce. De telles attaques peuvent compromettre la sécurité du système en donnant accès à des informations confidentielles, en compromettant l’intégrité de données sensibles ou en perturbant le fonctionnement pendant l’exécution. Dans cette thèse, nous décrivons des propriétés de sécurité permettant d’exprimer les garanties du système et établissons un modèle d’attaque de haut niveau définissant les capacités d’un attaquant à modifier le système. Ces propriétés et ce modèle nous servent à vérifier la sécurité du code par analyse statique ou test dynamique, combinés avec l’injection d’attaques, simulant les conséquences logicielles des fautes physiques. Deux méthodologies sont ainsi développées afin de vérifier le comportement fonctionnel du code sous attaques, tester le fonctionnement des sécurités implémentées et identifier de nouvelles attaques. Ces méthodologies ont été mises en oeuvre dans un cadre industriel afin de faciliter le travail du développeur chargé de sécuriser un code de carte à puce. / This thesis focuses on the effects of attacks by physical faults on embedded source code specifically for smart cards. Such attacks can compromise the security of the system by providing access to confidential information, compromising the integrity of sensitive data or disrupting the execution flow. In this thesis, we describe security properties to express security guarantees on the system. We also offer an attack model defining at high level an attacker’s ability to disrupt the system. With these properties and model, we check the source code security against physical attacks. We use static analysis and dynamic testing, combined with attack injection to simulate the consequences of physical faults at software level. Two techniques are created to stress the functional behavior of the code under attack, test the reliability of built-in security countermeasures and identify new threats. These techniques were implemented in a framework to help developers secure their source code in an industrial environment.

CIRQUEIRA, Alexandre Correia. Um Mecanismo de Segurança com Adaptação Dinâmica em Tempo de Execução para Dispositivos Móveis. 2011. 110 f. : Dissertação (mestrado) - Universidade Federal do Ceará, Centro de Ciências, Departamento de Computação, Fortaleza-CE, 2011. / Submitted by guaracy araujo (guaraa3355@gmail.com) on 2016-05-19T19:32:40Z No. of bitstreams: 1 2011_dis_accirqueira.pdf: 5491223 bytes, checksum: 7f1b8cc28f5bf56687e6d0e34acc337f (MD5) / Approved for entry into archive by guaracy araujo (guaraa3355@gmail.com) on 2016-05-19T19:33:29Z (GMT) No. of bitstreams: 1 2011_dis_accirqueira.pdf: 5491223 bytes, checksum: 7f1b8cc28f5bf56687e6d0e34acc337f (MD5) / Made available in DSpace on 2016-05-19T19:33:29Z (GMT). No. of bitstreams: 1 2011_dis_accirqueira.pdf: 5491223 bytes, checksum: 7f1b8cc28f5bf56687e6d0e34acc337f (MD5) Previous issue date: 2011 / The increasing use of mobile devices, wireless networks and mobile applications highlights the importance of ensuring information security. This concern arises because of the risks involved in traffic sensitive information via wireless, since it does not limit the risk of attacks, as in conventional networks. Additionally, the trend in the use of sustainable practices advocated by the Green Computing imposes the need for designing flexible applications that seek to reduce consumption of resources such as energy. Thus, mechanisms for providing confidentiality of information passing over the wireless medium should consider the efficient allocation of computing resources. This is a key issue to be considered when designing secure mobile applications. Therefore, the protection mechanisms should balance the security level required in accordance with the consumption of resources allocated to provide it. The use of information that characterizes the current situation (context) can assist in this task. Thus, the use of appropriate protective security requirements of applications and combined with the context can identify situations where you need to raise or lower the security level in order to reduce the resource consumption of the device. This work proposes a Security Mechanism Dynamic Adaptation (MeSAD), focusing on confidentiality, able to adapt the level of security according to the context and reduce the resource consumption of mobile devices. The main objective is to find the balance point in the tradeoff between the level of security and resource consumption. In order to achieve this goal, this paper presents a tool to support the use of MeSAD during the development of mobile applications, and enable the assessments on the performance of cryptographic algorithms that are used in different devices. / A crescente utilização de dispositivos móveis, redes sem fio e aplicações móveis evidencia a importância da garantia de segurança da informação. Esta preocupação surge devido aos riscos envolvidos no tráfego de informações sensíveis por meio sem fio, uma vez que o meio não limita os riscos de ataques, tal como nas redes convencionais. Adicionalmente, a tendência no uso de práticas sustentáveis defendidas pela Computação Verde impõe a necessidade de concepção de aplicações flexíveis que busquem a redução do consumo de recursos, como o de energia. Assim, mecanismos para o provimento de confidencialidade de informações que trafegam por meio sem fio devem considerar a alocação eficiente de recursos computacionais. Esta é uma questão chave a ser considerada no momento da concepção de aplicações móveis seguras. Portanto, os mecanismos de proteção devem balancear o nível de segurança requerido de acordo com o consumo de recursos alocados para provê-lo. O emprego de informações que caracterizam a situação corrente (contexto) pode auxiliar nessa tarefa. Assim, a utilização de proteção adequada aos requisitos de segurança das aplicações e combinada com o contexto pode identificar situações nas quais será necessário aumentar ou diminuir o nível de segurança, de forma a diminuir o consumo de recursos do dispositivo. Esse trabalho propõe, portanto, um Mecanismo de Segurança com Adaptação Dinâmica (MeSAD), com foco na confidencialidade, capaz de adaptar o nível de segurança de acordo com o contexto e reduzir o consumo de recursos dos dispositivos móveis. O objetivo principal consiste em encontrar o ponto de equilíbrio no tradeoff entre nível de segurança e consumo de recursos. A fim de atingir este objetivo, este trabalho apresenta também uma ferramenta de suporte à utilização do MeSAD durante o desenvolvimento de aplicações móveis, além de possibilitar a realização de avaliações sobre o desempenho dos algoritmos criptográficos que são utilizados nos diferentes dispositivos.

Magister Legum - LLM (Criminal Justice and Procedure) / The combating of money laundering has become crucial since it has escalated from a domestic to an international problem and vice versa. South Africa, in an attempt to combat money laundering has enacted anti-money laundering (AML) and anti-terrorism legislation. The legislation consists of the Prevention of Organised Crime Act 121 of 1998 (POCA); the Financial Intelligence Centre Act 38 of 2001 (FICA); and the Protection of Constitutional Democracy against Terrorist and Related Activities Act 33 of 2004 (POCDATARA). In essence POCA and POCDATARA criminalise money laundering and terrorist financing. FICA requires certain professions, such as the legal profession to maintain specific controls. Such controls include AML measures, combating the financing of terrorism (CFT) and also require the keeping of confidential client records, the filing of suspicious transaction reports (STR's) and certain cash transaction reports (CTR's).

Made available in DSpace on 2014-06-11T19:27:45Z (GMT). No. of bitstreams: 0 Previous issue date: 2011-02-22Bitstream added on 2014-06-13T20:56:48Z : No. of bitstreams: 1 freire_acgf_me_araca.pdf: 755676 bytes, checksum: 7a092fa66a756e57e901651ea75ca554 (MD5) / Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP) / O trabalho executado pelos profissionais auxiliares da odontologia constitui uma ferramenta diferenciada para se obter um aumento de produtividade, principalmente no que se refere ao serviço público de saúde. Para o cirurgião-dentista alcançar a produtividade máxima, os auxiliares precisam ter conhecimento de suas funções segundo as legislações vigentes. Esses conhecimentos abrangem a parte técnica e as posturas éticas desses profissionais, buscando uma humanização dos serviços na odontologia e a promoção dos direitos dos pacientes. Sendo assim, o consentimento informado e o sigilo profissional devem ser respeitados na prática odontológica, não apenas como uma doutrina legal, mas como um direito moral dos pacientes e que gera obrigações morais para os Cirurgiões- Dentistas e pessoal auxiliar. O objetivo foi avaliar o conhecimento dos Técnicos em Saúde Bucal (TSB) e Auxiliar de Saúde Bucal (ASB) quanto à realização de suas funções regulamentadas pela Lei Nº 11.889, de 24 de dezembro de 2008, assim como a formação destes e capacitação recebida antes de exercerem suas funções no sistema publico de saúde; avaliar também o conhecimento destes em relação aos conceitos bioéticos, no que diz respeito ao consentimento informado e sigilo profissional, aprendidos durante os cursos de formação ou prática profissional dentro do sistema público de saúde. A população alvo do presente estudo foram os TSB e ASB (N=76) que atuam no sistema público de 5 municípios da área de abrangência do DRS II-SP. A coleta dos dados foi realizada através de questionários semiestruturados e auto-administrados, com questões abertas e fechadas. A taxa resposta foi de 90,79% (n= 69). Os resultados mostraram que a maioria dos profissionais conhece parte de suas funções (56%). Quase metade dos profissionais tem curso de formação (47,8%). Quanto às... / The work made by dental auxiliaries is a different tool to obtain an increase of productivity, principally about public health service. It’s necessary that auxiliaries have knowledge about their role according current Law, and so, dental surgeon get the maximum productivity. This knowledge involves techniques and ethical postures of them, aiming humanization on dental services and promotion of patient’s rights. So, informed consent and professional secrecy should be respected on dental practice, not only like a legal doctrine, but like a moral right of patients and that cause moral duties for dental surgeons and dental auxiliaries. The aim of this study was to evaluate the knowledge of hygienists (TSB) and dental auxiliaries (ASB) about performance of their roles regulated by Law number 11.889, December 24th, 2008, evaluate the formation of them and capacitating received before they had executed their roles on Public Health System; to evaluate the knowledge of them about bioethical means, in relation to informed consent and professional secrecy, learned during courses of formation or professional practice into public health system. The target population of this study were TSB and ASB (N=76) that work on public health system from 5 cities belong to DRS II-SP. Data collection was performed through semi-structured questionnaire and self-applied, with opened and closed questions. The answer rate was 90,79% (n=69). The results showed that the majority of professionals know part of their roles (56%). Near half of them has formation course (47,8%). About received information during current course, 80% affirmed had received all information that are necessary for their formation, however, 84% affirmed feel necessity of actualization of their knowledge to develop their works. 58% of researched professionals said that they didn’t receive capacitating after ... (Complete abstract click electronic access below)

Medical records are being adjusted to match the practical way of understanding an illness as a disorder in the balanced state of the organism. This approach has also modified opinions regarding the form of medical documentation, the determination of necessary examinations and treatment. The progress in medicine along with the growing need for specific medical information made it necessary to look for new ways of making medical information available. One of these ways is to make the system of health care documentation electronic. The main tool of this system is an electronic health card. The objective of my work was to find out the following: the extent of utilization of electronic health cards; doctors´ opinions regarding the use of electronic medical documentation; the attitude of patients to medical documentation and the willingness of doctors to join the IZIP project of electronic health cards. Two hypotheses were checked for the purpose of the graduation work. Hypothesis no. 1 {--} Medical personnel expect that the project of electronic health cards will speed up the process of providing information about patients´ state of health. Hypothesis no. 2 {--} Health care facilities are willing to keep electronic documentation only if they receive compensation for increased administrative activities. To check the hypotheses, the author used the method of quantitative research. Data was collected by means of a questionnaire. The research was carried out between January and March 2009. The research was performed in health care facilities in South Bohemia represented by private doctors. 200 questionnaires were printed out. 152 of these could be fully used for the research. Hypothesis no. 1 was confirmed since 58% of the people who filled out the questionnaire agreed with the statement that the project of electronic health cards would accelerate the process of sharing information about patients´ state of health. Hypothesis no. 2 was not confirmed. There are two main problems preventing the use of IZIP; one of them is that patients are not interested and the other that doctors do not trust the system. That is why the necessary information is not always found in the IZIP since some health care facilities do not work with the system. Doctors would have to be forced or sufficiently motivated to transfer to the use of electronic medical documentation and they would have to change their negative attitude to modern technologies. This work could extend the information about medical documentation and electronic health cards among health care providers and the broader public and give feedback to people working in health care facilities.

Submitted by Cláudia Bueno (claudiamoura18@gmail.com) on 2016-01-29T14:17:13Z No. of bitstreams: 2 Dissertação - Inael Rodrigues de Oliveira Neto - 2015.pdf: 3158226 bytes, checksum: 9d8ebb3f5b3305532b92d7e59da8184e (MD5) license_rdf: 23148 bytes, checksum: 9da0b6dfac957114c6a7714714b86306 (MD5) / Approved for entry into archive by Luciana Ferreira (lucgeral@gmail.com) on 2016-02-01T11:48:51Z (GMT) No. of bitstreams: 2 Dissertação - Inael Rodrigues de Oliveira Neto - 2015.pdf: 3158226 bytes, checksum: 9d8ebb3f5b3305532b92d7e59da8184e (MD5) license_rdf: 23148 bytes, checksum: 9da0b6dfac957114c6a7714714b86306 (MD5) / Made available in DSpace on 2016-02-01T11:48:51Z (GMT). No. of bitstreams: 2 Dissertação - Inael Rodrigues de Oliveira Neto - 2015.pdf: 3158226 bytes, checksum: 9d8ebb3f5b3305532b92d7e59da8184e (MD5) license_rdf: 23148 bytes, checksum: 9da0b6dfac957114c6a7714714b86306 (MD5) Previous issue date: 2015-10-14 / The Internet of Things (IoT) connects the Internet all kinds of “things” or “smart objects” such as devices, sensors, actuators, mobile phones, home appliances, cars and even furniture. IIoT is characterized by the ubiquity and dynamism of its environment and connected objects. Thus, the environment of the IoT is highly volatile and heterogeneous as it counts with the presence of different objects able to interact and to cooperate with each other over the Internet. While Smart Objects become more ubiquitous, there is growing uncertainty about the environment, which contributes to a greater appearance of security threats not foreseen in the design phase. This thesis presents a solution that aims to ensure flexibility by allowing the safety requirements to be changed at runtime by the user, systematically reflecting these changes to the security settings for objects connected to the IoT. Therefore, this work presents an architecture of middleware and implementation of an algorithm for assessment requirements and security reconfiguration as well as its evaluation. In addition, this work presents a domain-specific modeling language using models@runtime for specifying the user’s security requirements. About the contributions of this work, we can mention the proposed architecture of middleware, a requirements synthesis algorithm for reconfiguration of security at runtime, a security requirement modeling language, the application of models@runtime approach for reconfiguration of security and the construction of a metamodel for capturing application security aspects running on devices in the IoT. / A Internet das Coisas (IoT) conecta na Internet todo tipo de coisas ou objetos inteligentes, tais como dispositivos, sensores, atuadores, telefones celulares, eletrodomésticos, carros e até mesmo móveis. Ela caracteriza-se pela ubiquidade e dinamismo do seu ambiente e objetos conectados. Com isso, o ambiente da IoT é altamente volátil e heterogêneo, pois ele conta com a presença de diferentes objetos capazes de interagir e cooperar uns com os outros através da Internet. Ao passo que objetos inteligentes se tornam mais ubíquos, há uma crescente incerteza sobre o ambiente, o que contribui com um maior surgimento de ameaças de segurança não previstas na fase de projeto. Esta dissertação apresenta uma solução que objetiva garantir flexibilidade nos requisitos de segurança para serem alterados pelo usuário em tempo de execução e refletir sistematicamente sobre essas mudanças nas configurações de segurança em objetos conectados na IoT. Para isso, este trabalho apresenta uma arquitetura de middleware e a implementação de um algoritmo para avaliação de requisitos e reconfiguração da segurança. Além disso, este trabalho apresenta uma linguagem de modelagem de domínio específico usando models@ runtime para especificação dos requisitos de segurança do usuário. Entre as contribuições deste trabalho, podemos citar a proposta de arquitetura de middleware, um algoritmo de síntese de requisitos para reconfiguração da segurança em tempo de execução, a linguagem de modelagem de requisitos de segurança, a aplicação da abordagem de modelos em tempo de execução para reconfiguração da segurança e a construção de um metamodelo que captura de aspectos de segurança de aplicações executando em dispositivos na IoT.

FundaÃÃo Cearense de Apoio ao Desenvolvimento Cientifico e TecnolÃgico / Os dispositivos mÃveis tÃm limitaÃÃes de recursos que restringem o uso de mecanismos de seguranÃa em aplicaÃÃes, tais como comÃrcio eletrÃnico, as quais exigem, por exemplo, o requisito de confidencialidade. Como à indispensÃvel a implementaÃÃo de mecanismos de seguranÃa nesse tipo de aplicaÃÃes, à fundamental auxiliar os desenvolvedores na escolha de um mecanismo que respeite limitaÃÃes, por exemplo, de desempenho, memÃria e bateria, dos dispositivos mÃveis. Esta dissertaÃÃo propÃe entÃo um modelo para medir o grau de confidencialidade e de desempenho necessÃrios para determinadas aplicaÃÃes que irÃo executar em dispositivos mÃveis. A fim de escolher o algoritmo criptogrÃfico e/ou o protocolo mais adequado a uma aplicaÃÃo mÃvel especÃfica, os cÃlculos da confidencialidade e desempenho sÃo realizados atravÃs de medidas jà definidas no modelo e de pesos definidos pelo desenvolvedor, de acordo com a relevÃncia de cada medida para aplicaÃÃo. Para especificar a proposta, as abordagens de Goal-Question-Metric (GQM), Goal-Driven Software Measurement (GDSM), variaÃÃes destas abordagens e o Security Measurement (SM) framework sÃo utilizados. Em seguida, para validar o modelo, à utilizada uma aplicaÃÃo mÃvel segura jà existente como estudo de caso, sendo feita a anÃlise e cÃlculo dos graus de confidencialidade e desempenho de algoritmos e protocolos / Mobile devices have resource restrictions that constrain the use of security mechanisms in applications, such as e-commerce, which demand, for example, confidentiality issues. There is then a need for a mechanism to help developers to choose the appropriate solution that provides security for a specific mobile device application, taking in consideration the limitation of performance, memory and battery, among others. Thus, this work proposes a security measurement model focused on confidentiality and performance for mobile applications. This model is defined in conformance with the cryptographic algorithm and/or protocol more adequate to the mobile application. Confidentiality and performance degrees are calculated according to the proposed model measurements and weights defined by the secure mobile application developer. . The following measurement approaches are used to specify the proposal: Goal-Question-Metric (GQM) and Goal-Driven Software Measurement (GDSM), variations of these approaches, and the Security Measurement (SM) framework. As a case study, a mobile application already existent is used for the analysis and calculation of the confidentiality and performance degrees of chosen algorithms and protocols

Hantering av information blir allt viktigare i dagens informationssamhälle då information är en av de värdefullaste tillgångarna för verksamheter. Syftet med uppsatsen har varit att skapa ett styrdokument för IT-administratörer som hjälper dem vid klassificering av informationssystem. Styrdokumentet har som uppgift att kontrollera att informationssystem lever upp till verksamheternas krav som finns på konfidentialitet, integritet, tillgänglighet och spårbarhet. Styrdokumentets vetenskapliga värde har verifierats genom att utvalda IT-administratörer undersökt och utvärderat styrdokumentet. Resultatet visar att styrdokumentet kan användas som ett hjälpmedel. Det är lättförståeligt, lämpar sig för mindre tekniska personer och kan även i vissa fall effektivisera klassificeringsprocessen. Slutsatsen är att behovet av denna typ av styrdokument för klassificering av informationssystem behövs inom verksamheter. / Information management is increasingly important in today’s information society as information is one of the most valuable assets for businesses. The purpose of this paper was to create a steering document for IT administrators and to help them when classifying information systems. The steering document is responsible for verifying that information systems meet businesses requirements of confidentiality, integrity, availability, and traceability. The scientific value of the steering document has been verified by selected IT administrators, who have investigated and evaluated it. The results show that the steering document may be used as a guideline for information system classification. It is easily understandable, suitable for less technical people, and may in some cases make the classification process even more efficient. The conclusion is that this type of steering document for information system classification is needed within businesses.

La quantité de données stockées dans le monde ne cesse de croître et cela pose des challenges aux fournisseurs de service de stockage qui doivent trouver des moyens de faire face à cette croissance de manière scalable, efficace, tout en optimisant les coûts. Nous nous sommes intéressés aux systèmes de stockage de données dans le nuage qui est une grande tendance dans les solutions de stockage de données. L'International Data Corporation (IDC) prédit notamment que d'ici 2020, environ 40% des données seront stockées et traitées dans le nuage. Cette thèse adresse les challenges liés aux performances d'accès aux données et à la sûreté de fonctionnement dans les systèmes de stockage dans le nuage. Nous avons proposé Mistore, un système de stockage distribué que nous avons conçu pour assurer la disponibilité des données, leur durabilité, ainsi que de faibles latences d'accès aux données en exploitant des zones de stockage dans les box, les Points de Présence (POP), et les centre de données dans une infrastructure Digital Subscriber Line (xDSL) d'un Fournisseur d'Accès à Internet (FAI). Dans Mistore, nous adressons aussi les problèmes de cohérence de données en fournissant plusieurs critères de cohérence des données ainsi qu'un système de versioning. Nous nous sommes aussi intéressés à la sécurité des données dans le contexte de systèmes de stockage appliquant une déduplication des données, qui est l'une des technologies les plus prometteuses pour réduire les coût de stockage et de bande passante réseau. Nous avons conçu une méthode de déduplication en deux phases qui est sécurisée contre des attaques d'utilisateurs malicieux tout en étant efficace en termes d'économie de bande passante réseau et d'espace de stockage. / The quantity of data in the world is steadily increasing bringing challenges to storage system providers to find ways to handle data efficiently in term of dependability and in a cost-effectively manner. We have been interested in cloud storage which is a growing trend in data storage solution. For instance, the International Data Corporation (IDC) predicts that by 2020, nearly 40% of the data in the world will be stored or processed in a cloud. This thesis addressed challenges around data access latency and dependability in cloud storage. We proposed Mistore, a distributed storage system that we designed to ensure data availability, durability, low access latency by leveraging the Digital Subscriber Line (xDSL) infrastructure of an Internet Service Provider (ISP). Mistore uses the available storage resources of a large number of home gateways and Points of Presence for content storage and caching facilities. Mistore also targets data consistency by providing multiple types of consistency criteria on content and a versioning system. We also considered the data security and confidentiality in the context of storage systems applying data deduplication which is becoming one of the most popular data technologies to reduce the storage cost and we design a two-phase data deduplication that is secure against malicious clients while remaining efficient in terms of network bandwidth and storage space savings.

Please read the abstract in the dissertation Copyright / Dissertation (MSW)--University of Pretoria, 2010. / Social Work and Criminology / unrestricted