Orientador: Ricardo Dahab / Dissertação (mestrado) - Universidade Estadual de Campinas, Instituto de Computação / Made available in DSpace on 2018-08-13T10:53:28Z (GMT). No. of bitstreams: 1 Magalhaes_KarinaMochettide_M.pdf: 3703797 bytes, checksum: 931cd070eb909803435fa87f05e0f83c (MD5) Previous issue date: 2009 / Resumo: Marcas d'água vem sendo utilizadas em vários tipos de arquivos de multimídia, como áudio, vídeo e imagens de bitmap, para combater sua copia e distribuição ilegais. Somente com a popularização dos Sistemas de Informação Geográfica (GIS) e da utilização de dados espaciais na Web, marcas d'água para mapas vetoriais ganharam maior atenção, principalmente porque este tipo de imagem possui produção cara, mas pode ser reproduzido facilmente. Esse trabalho revisa o método RAWVec, que insere uma marca d'água representada por uma imagem raster ou bitmap num mapa vetorial, e apresenta uma alternativa publica para tal método. / Abstract: Watermarks have been used for a long time in several digital media to avoid the illegal copy and distribution of these items. Only with the popularization of Geographic Information Systems (GIS) and the use of spatial data on the Web, watermarks for vector maps gained more attention, mostly because vector maps are expensive to produce, but easy to copy. This work reviews the RAWVec Method that embeds a watermark, in the form of a bitmap image, into digital vector maps; and presents a semi-blind alternative method. / Mestrado / Mestre em Ciência da Computação

M.Sc. (Computer Science) / Information is a valuable resource in any organisation and more and more organisations are realising this and want efficient means to protect it against disclosure, modification or destruction. Although relatively efficient security methods have been available almost as long as information databases, they all provide additional cost. This cost does not only involve money but also cost in terms of system performance and management of information security. Any new information security model must also provide better management of information security. In this dissertation we present a model that provides information security and aims to lower the technical skills required to manage information security using this approach. In any business organisation we can describe each employee's duties. Put in other words, we can say that each employee has a specific business role in the organisation. In organisations with many employees there are typically many employees that have more or less the same duties in the organisation. This means that employees can be grouped according to their business roles. We use an employee's role as a description of his/her duties in a business organisation. ' Each role needs resources to perform its duties in the organisation. In terms of computer systems, each role needs computer resources such as printers. Most roles need access to data files in the organisation's database but it is not desirable to give all roles access to all data files. It is obvious that roles have specific privileges and restrictions in terms of information resources. Information security can be achieved by identifying the business roles in an organisation and giving these roles only the privileges needed to fulfill their business function and then assigning these roles to people (users of the organisation's computer system). This is called role-based security. People's business functions are related, for example clerks and clerk-managers are related in the sense that a clerk-manager is a manager of clerks. Business roles are related in the same way. For an information security manager to assign roles to users it is important to see this relationship between roles. In this dissertation we present this relationship using a lattice graph which we call a role lattice. The main advantage of this is that it is eases information security management...

The importance of information in business today has made the need to properly secure this asset evident. Information security has become a responsibility for all managers of an organization. To better support more efficient management of information security, timely information security management information should be made available to all managers. Smaller organizations face special challenges with regard to information security management and reporting due to limited resources (Ross, 2008). This dissertation discusses a Framework for Information Security Management Information (FISMI) that aims to improve the visibility and contribute to better management of information security throughout an organization by enabling the provision of summarized, comprehensive information security management information to all managers in an affordable manner.

Background: Higher Education (HE), through HE Institutions, plays a very important role in society. There is thus a need for this sector to be well managed, especially with regards to planning, organising, and controlling. Corporate Governance has received a lot of attention in recent times, especially to engender trust on the part of the stakeholders. There are many similarities, but also significant differences in the governance of HE institutions and public companies. Information Technology (IT) plays an extremely important role in the modern organisation, creating huge opportunities, but also increasing the risk to the organisation. Therefore, effective governance of IT in HE Institutions is of great importance.

Den 25 maj 2018 kommer Personuppgiftslagen (PuL) att ersättas av EU-förordningen GeneralData Protection Regulation (GDPR). Denna studie har granskat vilka skillnader som finnsmellan GDPR och PuL och även hur företag planerar att hantera de förändringar som GDPRkommer att medföra. Även om GDPR i många avseende är lik PuL kommer den nyaförordningen att påverka allt ifrån den enskilda individen till de största organisationerna.Förordningen kommer innebära mer rättigheter och bättre skydd för den registrerade, vilketbetyder att det kommer ställas högre krav på de företag som behandlar personuppgifter. De nya kraven kommer innebära ett omfattande anpassningsarbete inom flera områden. Delskommer det behöva ske administrativa och juridiska förändringar inom verksamheten i form avnya eller uppdaterade avtal. Det kan även komma att krävas tekniska åtgärder för att hanterafrågor som “Rätten att bli glömd”, ”Dataportabilitet”, ”Registerföring” samt det förstärktaskyddet av personuppgifter. Det ställs även krav på att personuppgiftsincidenter måsterapporteras till tillsynsmyndigheten vid upptäckande. Då tillämpningsområdet utökas medfördetta att personuppgifter som lagras ostrukturerat kommer omfattas av lagstiftningen. För attuppnå efterlevnad av förordningen införs krav på att i vissa fall utse ett “Dataskyddsombud” iverksamheten; tillsynsmyndigheten får även befogenhet till att utdöma mycket kraftigasanktioner vid överträdelse av förordningen. Beroende på hur en verksamhets personuppgiftshantering ser ut i dagsläget kan dennaanpassning bli mer eller mindre omfattande. Anpassningsarbetets omfattning påverkas av ettantal faktorer exempelvis under vilka förutsättningar som behandlingen sker i nuläget och ivilken omfattning denna sker. Inställningen till förordningen bland företag är varierande, de som tar den på allvar har insettatt nya krav kommer att ställas på deras verksamheter och har påbörjat arbetet för att anpassasin verksamhet. Andra anser att de inte berörs i samma utsträckning och är därför inte likaoroliga. På det stora hela kommer förordningen göra att personuppgiftsbehandlingen inomEU/ESS blir säkrare även om resan dit kan kosta. / On the 25th of May 2018 the Swedish Personal Data Act (Personuppgiftslagen, PuL) will be replaced by the EU-regulation General Data Protection Regulation (GDPR). The aim of this study was to determine the big differences between PuL and the GDPR while also looking at how organisations plan to handle the changes that the new regulation will bring. PuL and GDPRare in many ways similar but there are some major changes that will affect every person and every organisation within the EU/EES. The regulation will mean better and morecomprehensive rights for the individual, which in turn will result in higher requirements beingput on the companies who process personal data. The new requirements will result in extensive work within several areas to adapt to the new regulation. The legal and administrative sections will need to review their current contracts & agreements and update them if necessary. There may also need to implement technical solutionsto manage the requirements concerning “the right to be forgotten”, “data portability”, “recordkeeping” and the improved protection of personal data. According to the regulationorganisations are required to notify the supervisory authority of any data breach concerningpersonal data. The change in material scope will result in personal data stored in an unstructuredway being covered by the GDPR. To make companies follow the new legislation thesupervisory authority gains the power to levy significant fines if organisations violate the newregulation; in addition some organisations will need to appoint a “Data protection officer”that’ll monitor the processing of personal data. There are several factors that will determine the amount of work required to reach compliance;for example the size of the corporation and the extent of their current processing of personaldata. The attitude to the new regulation vary, those that take the regulation seriously have realisedthat there will be new demands put on their business, and have already started to adapt theirbusiness to reach compliance with the regulation. There are others that deem that they will notbe affected to the same extent and are therefore not as worried. In the great scope of things, theregulation will make the processing of personal data more secure within the EU/EES eventhough the peregrination to reach compliance may turn out to be a costly one.

A privacy-policy matching engine may support users in determining if their privacy preferencesmatch with a service provider’s privacy policy. Furthermore, third parties, such asData Protection Agencies (DPAs), may support users in determining if a service provider’sprivacy policy is a reasonable privacy policy for a given service by issuing recommendationsfor reasonable data handling practises for different services. These recommendations needto be matched with service provider’s privacy policies, to determine if a privacy policy isreasonable or not, and with user’s privacy preferences, to determine if a set of preferencesare reasonable or not.In this thesis we propose a design of a new privacy-policy language, called the UPrIMPolicy Language (UPL). UPL is modelled on the PrimeLife Policy Language (PPL)and tries to improve some of PPL’s shortcomings. UPL also tries to include informationdeemed mandatory for service providers according to the European Data Protection Directive95/46/EC (DPD). In order to demonstrate the features of UPL, we developed aproof-of-concept matching engine and a set of example instances of UPL. The matchingengine is able to match preferences, policies and recommendations in any combination.The example instances are modelled on four stages of data disclosure found in literature.

A person who is communication about (the data subject) has to keep track of all of his revealed data in order to protect his right of informational self-determination. This is important when data is going to be processed in an automatic manner and, in particular, in case of automatic inquiries. A data subject should, therefore, be enabled to recognize useful decisions with respect to data disclosure, only by using data which is available to him. For the scope of this thesis, we assume that a data subject is able to protect his communication contents and the corresponding communication context against a third party by using end-to-end encryption and Mix cascades. The objective is to develop a model for analyzing the linkability of communication contents by using Formal Concept Analysis. In contrast to previous work, only the knowledge of a data subject is used for this analysis instead of a global view on the entire communication contents and context. As a first step, the relation between disclosed data is explored. It is shown how data can be grouped by types and data implications can be represented. As a second step, behavior, i. e. actions and reactions, of the data subject and his communication partners is included in this analysis in order to find critical data sets which can be used to identify the data subject. Typical examples are used to verify this analysis, followed by a conclusion about pros and cons of this method for anonymity and linkability measurement. Results can be used, later on, in order to develop a similarity measure for human-computer interfaces.

Cette thèse traite des problèmes et des défis de sécurité dans l’Internet des Objets (IdO). L’évolution de l’Internet classique vers l’Internet des Objets crée de nombreux challenges dans la manière de sécuriser les communications et soulève des problèmes liés au contraintes de l’internet des objets à savoir : objets à faibles ressources d’énergie et de calculs, hétérogénéité nuisant à l’interopérabilité des objets, taille du réseau de plus en plus grande, ... etc. En effet, Internet s’est développé d’un réseau d’ordinateurs personnels et de serveurs vers un immense réseau connectant des milliards d’objets intelligents communicants. Ces objets seront intégrés dans des systèmes complexes et utiliseront des capteurs et actionneurs pour observer et interagir avec leur environnement physique. Les exigences des interactions entre objets communicants en termes de sécurité dépendent du contexte qui évolue dans l’espace et le temps. Par conséquent, la définition de la politique de sécurité doit être adaptative et sensible au contexte. Un des problèmes auxquels nous nous sommes intéressés est le contrôle d’accès efficace à base de cryptographie d’attributs : « Attributes Based Encryption (ABE) ». Les schémas ABE (CP-ABE et KP-ABE) présentent plusieurs atouts pour l’implémentation d’un contrôle d’accès cryptographique. Par contre, ces schémas posent des défis opérationnels à cause de leurs complexités et leur surcoût élevé en termes de temps d’exécution et consommation énergétique. Pour pallier cet inconvénient, nous avons exploité l’hétérogénéité d’environnement Internet des Objets pour proposer des versions collaboratives et distribuées de ces schémas de contrôle d’accès cryptographique. Nos solutions réduisent considérablement le coût en termes d’énergie nécessaire à l’exécution. Le deuxième inconvénient des schémas ABE est l’inexistence de mécanismes efficaces de gestion de clés. Nous avons proposé des solutions pour le problème de révocation d’attributs dans le schéma CP-ABE, Ces solutions, en plus de leur efficacité, répondent à des exigences de sécurité différentes selon le cas d’applications. Nous avons proposé également, une solution à base de CP-ABE pour le problème du « grouping proof ». Le « grouping proof » consiste à fournir une preuve sur la coexistence, dans le temps et l’espace, d’un ensemble d’objets. Parmi les applications de notre solution, on peut citer le payement NFC et la sécurisation de l’accès aux locaux sensibles. / In this thesis, we deal with security challenges in the Internet of Things. The evolution of the Internet toward an Internet of Things created new challenges relating to the way to secure communications given the new constraints of IoT, namely: resource constrained objects, heterogeneity of network components, the huge size of the network, etc. Indeed, the Internet evolved from a network of computers and servers toward a huge network connecting billions of smart communicating objects. These objects will be integrated into complex systems and use sensors and actuators to observe and interact with their physical environment. The security requirements of the interactions between smart objects depend on the context which evolves in time and space. Consequently, the definition of the security policies should be adaptive and context-aware. In this thesis, we were interested in the problem of access control in IoT relying on Attribute based Encryption (ABE). Indeed, ABE schemes present many advantages in implementing a cryptographic fine-grained access control. However, these schemes raise many implementation challenges because of their complexity and high computation and energy overheads. To overcome this challenge, we leveraged the heterogeneity of IoT to develop collaborative and distributed versions of ABE schemes. Our solutions reduce remarkably the overhead in terms of energy consumption and computation. The second limitation of ABE schemes is the absence of efficient attribute/key revocation techniques. We have proposed batch based mechanisms for attribute/key revocation in CP-ABE. We demonstrated the efficiency of the proposed solutions through simulations. Finally, we have proposed a CP-ABE based solution for the problem of grouping proof. This problem consists of providing the proof that a set of objects are present simultaneously (same time and same location). The propose solution has many applications such as enforcing the security of NFC based payments and the access to sensitive locations.

Den tjugofemte maj 2018 träder EU:s nya dataskyddsförordning i kraft, GDPR, en lag som kommer att ersätta de 20 år gamla reglerna för hantering av personuppgifter i Sverige. Lagen ställer hårdare krav på företags datahantering, vilket kan innebära omfattande förändringar för organisationer som hanterar personuppgifter. Studien syftar till att ge en förståelse för hur företag förbereder sig för de förändringar som GDPR innebär. Resultatet baseras på semistrukturerade intervjuer med tre av de fyra största svenska e-handelsföretagen inom klädbranschen, som alla hanterar personuppgifter. Studien besvarar syfte och forskningsfråga och visar att företagen har en positiv inställning till den nya lagen samt att förberedelserna inletts.

Personal data is increasingly conceived as a tradable asset. Markets for personal information are emerging and new ways of valuating individuals' data are being proposed. At the same time, legal obligations over protection of personal data and individuals' concerns over its privacy persist. This article outlines some of the economic, technical, social, and ethical issues associated with personal data markets, focusing on the privacy challenges they raise.