Am 1. und 2. Dezember 2011 fand am Hasso-Plattner-Institut für Softwaresystemtechnik GmbH in Potsdam der 4. Deutsche IPv6 Gipfel 2011 statt, dessen Dokumentation der vorliegende technische Report dient. Wie mit den vorhergegangenen nationalen IPv6-Gipfeln verfolgte der Deutsche IPv6-Rat auch mit dem 4. Gipfel, der unter dem Motto „Online on the Road - Der neue Standard IPv6 als Treiber der mobilen Kommunikation” stand, das Ziel, Einblicke in aktuelle Entwicklungen rund um den Einsatz von IPv6 diesmal mit einem Fokus auf die automobile Vernetzung zu geben. Gleichzeitig wurde betont, den effizienten und flächendeckenden Umstieg auf IPv6 voranzutreiben, Erfahrungen mit dem Umstieg auf und dem Einsatz von IPv6 auszutauschen, Wirtschaft und öffentliche Verwaltung zu ermutigen und motivieren, IPv6-basierte Lösungen einzusetzen und das öffentliche Problembewusstsein für die Notwendigkeit des Umstiegs auf IPv6 zu erhöhen. Ehrengast war in diesem Jahr die EU-Kommissarin für die Digitale Agenda, Neelie Kroes deren Vortrag von weiteren Beiträgen hochrangiger Vertretern aus Politik, Wissenschaft und Wirtschaft ergänzt wurde. / This technical report is summarizing the talks and presentations of the 4th German IPv6 Summit 2011 at the Hasso Plattner Institute for Software System Engineering in Potsdam on December 1./2. 2011. The goal of this summit was to present current developments concerning the implementation of the new IPv6 technology from political and economic perspectives, as well as from a technological point of view. According to the motto 'Online on the Road - The New Technology Standard IPv6 as Driving Force for Mobile Communications" this year's focus was on automobile networking and communication. This year's guest of honor was EU commissioner for Digital Agenda Neelie Kroes. Besides her, the conference was complemented by talks and presentations of high-ranking representatives from industry, government, and research.

With the rapid development of information technology, data availability is improved greatly. Data may be accessed at anytime by people from any location. However,threats to data security and privacy arise as one of the major problems of the development of information systems, especially those information systems which contain personal information. An association database is a personal information system which contains associations between persons. In this thesis, we identify the security and privacy problems of association databases. In order to solve these problems, we propose a new security and privacy model for association databases equipped with both direct access control and inference control mechanisms. In this model, there are multiple criteria including, not only confidentiality, but also privacy and other aspects of security to classify the association. The methods used in the system are: The direct access control method is based on the mandatory model; The inference control method is based on both logic reasoning and probabilistic reasoning (Belief Networks). My contributions to security and privacy model for association databases and to inference control in the model include: Identification of security and privacy problems in association databases; Formal definition of association database model; Representation association databases as directed multiple graphs; Development of axioms for direct access control; Specification of the unauthorized inference problem; A method for unauthorized inference detection and control that includes: Development of logic inference rules and probabilistic inference rule; Application of belief networks as a tool for unauthorized inference detection and control.

With the rapid development of information technology, data availability is improved greatly. Data may be accessed at anytime by people from any location. However,threats to data security and privacy arise as one of the major problems of the development of information systems, especially those information systems which contain personal information. An association database is a personal information system which contains associations between persons. In this thesis, we identify the security and privacy problems of association databases. In order to solve these problems, we propose a new security and privacy model for association databases equipped with both direct access control and inference control mechanisms. In this model, there are multiple criteria including, not only confidentiality, but also privacy and other aspects of security to classify the association. The methods used in the system are: The direct access control method is based on the mandatory model; The inference control method is based on both logic reasoning and probabilistic reasoning (Belief Networks). My contributions to security and privacy model for association databases and to inference control in the model include: Identification of security and privacy problems in association databases; Formal definition of association database model; Representation association databases as directed multiple graphs; Development of axioms for direct access control; Specification of the unauthorized inference problem; A method for unauthorized inference detection and control that includes: Development of logic inference rules and probabilistic inference rule; Application of belief networks as a tool for unauthorized inference detection and control.

<p> As cyber threats become highly damaging and complex, a new cybersecurity compliance certification model has been developed by the Department of Defense (DoD) to secure its Defense Industrial Base (DIB), and communication with its private partners. These partners or contractors are obligated by the Defense Federal Acquisition Regulations (DFARS) to be compliant with the latest standards in computer and data security. The Cybersecurity Maturity Model Certification (CMMC), and it is built upon existing DFARS 252.204-7012 and the NIST SP 800-171 controls. As of 2020, the DoD has incorporated DFARS and the National Institute of Standards and Technology (NIST) recommended security practices into what is now the CMMC. This thesis examines the most commonly identified security control deficiencies faced, the attacks mitigated by addressing these deficiencies, and suggested remediations, to 127 DoD contractors in order to bring them into compliance with the CMMC guidelines. By working with a compliance service provider, an analysis is done on how companies are undergoing and implementing important changes in their processes, to protect crucial information from ever-growing and looming cyber threats. </p>

The computer game industry has during the past years performed a paradigm shift from physical to digital online retailing based on game portals. Due to the many possibilities Big Data in combination with personalized marketing provides, especially in the form on in-game shops in the software, it is interesting for the computer game companies to investigate how this marketing approach can be performed most beneficially. Since the computer game industry has not been thoroughly investigated in relation to personalized marketing and customer integrity, it has in this study been performed as a predictive research, based on how personalized marketing is used in other industries. This benchmark has been combined with a literature study as well as a case study on a Swedish computer game company, Paradox Interactive in the form of personal interviews, a customer survey as well as gathering of internal data. The analysis of the chosen industries, the grocery store industry, the travel and hospitality industry as well the online gambling industry, demonstrates the importance of offering the customers relevant marketing offers that benefits the customers as well as the company. This approach has been shown to imply a positive spiral of increased customer loyalty and raised revenue for the company. The performed customer surveys emphasizes high loyalty, satisfied customers, positive attitude for a loyalty program as well as for an in-game shop as well as a majority of positively minded customers for personalized marketing. The negatively minded was shown to be affected by data security, the feeling of being monitored as well as the fear for data spread. The investigation further shows a high level of technology knowledge among the computer game customers. This increases the importance of offering high data security as well as describes the used approaches for the customers. Based on these results recommendations related to the implementation of personalized marketing was developed for computer game companies. These emphasizes the importance of using secure techniques related to the data security and the explicit information related to this, which is argued to lead to increased trust amongst the customers and an increased willingness to share personal data. Further the data and information related to the customers should be gathered from different sources and be analyzed together in order to increase the deep of the knowledge about the customers, which enables more accurate and relevant offers. This relevance should be high, but well balanced in relation to the negative aspects related to customers’ possible feeling of being monitored.   For increased knowledge about the customers as well improved customer loyalty the computer game companies should implement loyalty programs, which should be well aligned with the image of the company. This study contributes to the theoretical field related to personalized marketing by investigating how current models and theories aligns with, or should be modified in order to match, the computer game industry. Besides from this it contributes with theories related to data security within the field of personalized marketing, focused on personal integrity and privacy. Theories related to the importance of trust from the customers and the relation between trust and loyalty has been verified for the computer game industry. The importance of identifying a well-balanced level of the personalization has been verified, which in turn falsifies the theories emphasizing that maximized personalization is to strive for. Theories related to key aspects to take into consideration related to data security and handling of personal data has been verified for the computer game industry related to the handling of Big Data. / Dataspelsindustrin har under åren gjort en resa från fysisk försäljning i butik till digital försäljning via spelportaler på internet. I och med de många möjligheter Big Data i kombination med personlig marknadsföring möjliggör, speciellt i formatet av en inbyggd försäljningskanal inuti mjukvaran, är det av stort intresse för företag i spelbranschen att undersöka hur personlig marknadsföring mest fördelaktigt utförs.  I och med att dataspelinsdustrin ej blivit undersökt med avseende på personlig marknadsföring och kunders integritet tidigare, har detta utförts i form av en förutsägande undersökning baserat på användning av personlig marknadsföring i andra industrier. Denna utvärderande analys har kombinerats med en litteraturstudie samt en fallstudie på det svenska dataspelsföretaget Paradox Interactive i form av intervjuer, en kundenkät samt insamling av intern data. Analysen av de valda industrierna, matvaruhandeln, rese- och hotellindustrin och onlinespelindustrin, påvisar vikten av att erbjuda kunderna relevanta erbjudanden som i längden gynnar såväl kunden som företaget. Detta har påvisats leda till en god spiral av ökad kundlojalitet och ekonomisk vinst för företaget. Utförda kundundersökningar påvisar hög lojalitet, nöjda kunder, positiv attityd till sålväl en inbyggd butik i mjukvaran som ett lojalitetsprogram samt en övervägande andel positiva attityder för personlig marknadsföring. De negativt inställda påverkas av såväl datasäkerheten, känslan av att vara övervakad samt rädslan för att data sprids till tredje part. Undersökningen visar även på en hög kunskapsnivå inom data hos kunderna, vilket höjer vikten av att erbjuda hög säkerhet och även av att förmedla detta till dem. Baserat på dessa resultat har rekommendation gällande implementationen av personlig marknadsföring tagit fram för dataspelsföretag. Dessa framhäver vikten av att ha hög datasäkerhet och förmedla detta till kunderna, vilket i sin tur gör kunderna mer trygga och villiga att dela personlig information. Vidare bör data och information om kunderna skall samlas in från olika kanaler och analyseras tillsammans i syfte att öka kunskapem om kunder, vilket ger möjligheten att erbjuda kunderna mer träffsäkra och relevanta erbjudanden. Denna relevans skall vara hög, men väl avvägd mot den negativa effekten som uppstår om kunden känner sig övervakad.   För utökad kunskap om kunderna och samtidigt generera höjd kundlojalitet skall företag i industrin implementera lojalitetsprogram, vilka skall vara enhetlig med företagets framtoning. Detta arbete bidrar till teorier inom personlig markandsföring genom att undersöka hur rådande teorier och modeller passar eller skall ändras för att matcha dataspelindustrin. Utöver detta bidrar arbetet till teorier gällande datasäkerhet inom området personlig markandsföring, med fokus på integritet och privatliv. Teorier gällande vikten av fötroende från kunderna och sambandet mellan förtroende och lojalitet har påvisats stämma för dataspelindustrin. Vikten av att hitta ett mellanläge för markandsförings relevans har påvisats stämma, vilket i sin tur dementerar teorier som påvisar att maximal relevans är eftertraktat. Teorier gällande huvudaspekter att ta hänsyn till gällande datasäkerhet och behandling av personlig data har påvisats stämma för datapselindustrin relaterat till behandlingen av Big Data.

I uppsatsen beskrivs vad dark patterns är och hur de påverkar enskildas dataskydd. Det konstateras att metoderna faktiskt är ett gammalt fenomen som nu även förekommer inom den relativt nya datadrivna marknaden i den digitala världen. Det finns flera olika varianter av dark patterns och de kan förefalla överlappa varandra. Gemensamt är att dark patterns inom data-skydd påverkar enskildas integritetsval genom att nudgea enskilda till att dela personuppgifter. Metoderna inverkar på enskildas rätt till kontroll över sina personuppgifter och därmed borde dark patterns i de flesta fall utgöra överträdelser av dataskyddet i EU. Ingen lagstiftning omfattar dark patterns uttryckligen men i uppsatsen visas på att det torde vara få dark patterns som inte träffas av gällande dataskyddsregler. Det är inte svagheter i gällande dataskyddsreglering som uppmärksammas i uppsatsen utan snarare svagheter i efterlevnad och tillsyn av vederbörande regler. Bristerna i tillsyn påverkar inte endast förekomsten av dark patterns utan det gäller för samtliga dataskyddsöverträdelser. I uppsatsen föreslås behov av ytterligare riktlinjer och klargöranden från EDPB för att effektivisera efterlevnad och tillsyn av gällande regler. Därutöver förespråkas ytterligare finansiering till dataskyddsmyndigheter samt utbildning av enskilda tillika konsumenter om vad dark patterns är. I uppsatsen analyseras även konsumentområdets koppling till dataskydd samt eventuella tillsynsansvar av dark patterns för att sedermera diskuteras som ett ytterligare alternativ till att motverka dark patterns. Uttryckliga förbud i EU-lagstiftningsakter anses också vara önskvärd för att öka efterlevnad. En utblick över framtida regleringar görs, dels i USA där reglering som uttryckligen omfattar dark patterns införs år 2023, dels i EU där ett uttryckligt förbud mot dark patterns är under förhandling till att införas i DSA. Samtidigt kan kakväggar, vilket är en typ av dark pattern, komma att bli delvis tillåtna i och med ePrivacy-förordningen

Telemedizin ist der Einsatz von Telekommunikation und Informatik, um medizinische Dienstleistungen zu erbringen oder zu unterstützen, wenn die Teilnehmer räumlich getrennt sind. Die einzelnen telemedizinischen Anwendungen sind im Vordringen begriffen. Telemedizin ist allerdings kein eigenes Fachgebiet, sondern eine Methode, herkömmliche medizinische Maßnahmen zu unterstützen und zu verbessern. Da die Teilnehmer telemedizinischer Anwendungen nicht am selben Ort und zur selben Zeit agieren müssen, ist Telemedizin prädestiniert für die Überwindung der Sektorierung des Gesundheitssystems. Telemedizin kann insbesondere Rationalisierungsreserven mobilisieren und medizinische Dienstleistungen effektiver und effizienter gestalten. Ungeachtet dessen gibt es fünf Problemfelder, die beobachtet und weiter entwickelt werden müssen, um Telemedizin auch für die Zukunft möglich zu machen: Die unterschiedlichen Kommunikationsstandards müssen harmonisiert werden, damit der Datenfluß zwischen den Teilnehmer optimiert werden kann. Krankenkassen und Leistungserbringer müssen gemeinsam eine solide Basis für die Finanzierung derjenigen telemedizinischen Dienstleistungen etablieren, die dem Stand der wissenschaftlichen Erkenntnis entsprechen. Telemedizin mit Auslandsbeteiligung zieht in der Regel haftungsrechtliche Kollisionen nach sich, die von den Teilnehmern durch eine Rechtswahl- und eine Gerichsstandsvereinbarung vermieden werden können. Die sozialrechtlichen Möglichkeiten, insbesondere solche, Praxisnetze zu bilden, müssen noch in Einklang mit den berufsrechtlichen Vorgaben gebracht werden, da diese einer überörtlichen Leistungserbringergemeinschaft und einer entsprechenden Information des Patienten zum Teil noch im Weg stehen.Die durch die Telemedizin neu entstehenden Möglichkeiten der Kommunikation müssen durch zusätzliche Maßnahmen für Datenschutz und Datensicherheit flankiert werden. Insbesondere bei Datenübertragungen ins Ausland sollten sich die Teilnehmer durch eine gesonderte Einwilligung des Patienten in diesen Datenfluß absichern. / Telemedicine is the use of information and telecommunication technologies to provide and support health care when distance separates the participants. The single uses of telemedicine are growing in quality and quantity. Telemedicine, however, is not a medical field of its own, but a tool that can be used in most fields of medicine to enhance and support communication procedures. Since the participants must not act at the same time and at the same venue, telemedicine is bound to overcome the sectoral boundaries in a health system, which is separated in an outpatient and an inpatient world. Telemedicine can help to mobilise the health systems rationalisation potential and make procedures more effective and more efficient. There still are five tasks that have to be observed and to be solved, to make telemedicine possible in the future: Harmonisation of communicational standards must progress to optimise communication between the participants. Health insurance funds and medical persons must cooperate to insure a solid basis of financing for telemedicinal procedures that are state of the art. Participants of cross-border telemedicine must be aware of colliding laws and are well advised to agree upon the law to be applied and the court in charge. The professional law for doctors in Germany must be reconciled with the managed care concepts of practice networks that are legally permissible in terms of social law. Data protection and data security must be ensured under the new conditions of telemedicine. Especially cross-border data flow should be based on the informed consent of the patient involved

Η ασφάλεια των υπολογιστικών συστημάτων αποτελεί πλέον μια πολύ ενεργή περιοχή και αναμένεται να γίνει μια νέα παράμετρος σχεδίασης ισάξια μάλιστα με τις κλασσικές παραμέτρους σχεδίασης των συστημάτων, όπως είναι η απόδοση, η κατανάλωση ισχύος και το κόστος. Οι φερέγγυες υπολογιστικές πλατφόρμες έχουν προταθεί σαν μια υποσχόμενη λύση, ώστε να αυξήσουν τα επίπεδα ασφάλειας των συστημάτων και να παρέχουν προστασία από μη εξουσιοδοτημένη άδεια χρήσης των πληροφοριών που είναι αποθηκευμένες σε ένα σύστημα. Ένα φερέγγυο σύστημα θα πρέπει να διαθέτει τους κατάλληλους μηχανισμούς, ώστε να είναι ικανό να αντιστέκεται στο σύνολο, τόσο γνωστών όσο και νέων, επιθέσεων άρνησης υπηρεσίας. Οι επιθέσεις αυτές μπορεί να έχουν ως στόχο να βλάψουν το υλικό ή/και το λογισμικό του συστήματος. Ωστόσο, η μεγαλύτερη βαρύτητα στην περιοχή έχει δοθεί στην αποτροπή επιθέσεων σε επίπεδο λογισμικού. Στην παρούσα διατριβή προτείνονται έξι μεθοδολογίες σχεδίασης ικανές να θωρακίσουν ένα υπολογιστικό σύστημα από επιθέσεις άρνησης υπηρεσίας που έχουν ως στόχο να πλήξουν το υλικό του συστήματος. Η κύρια έμφαση δίνεται στο υποσύστημα της μνήμης (κρυφές μνήμες). Στις κρυφές μνήμες αφιερώνεται ένα μεγάλο μέρος της επιφάνειας του ολοκληρωμένου, είναι αυτές που καλούνται να "αποκρύψουν" τους αργούς χρόνους απόκρισης της κύριας μνήμης και ταυτόχρονα σε αυτές οφείλεται ένα μεγάλο μέρος της συνολικής κατανάλωσης ισχύος. Ως εκ τούτου, παρέχοντας βελτιστοποιήσεις στις κρυφές μνήμες καταφέρνουμε τελικά να μειώσουμε τον χρόνο εκτέλεσης του λογισμικού, να αυξήσουμε το ρυθμό μετάδοσης των ψηφιακών δεδομένων και να θωρακίσουμε το σύστημα από επιθέσεις άρνησης υπηρεσίας σε επίπεδο υλικού. / Data security concerns have recently become very important, and it can be expected that security will join performance, power and cost as a key distinguish factor in computer systems. Trusted platforms have been proposed as a promising approach to enhance the security of the modern computer system and prevent unauthorized accesses and modifications of the sensitive information stored in the system. Unfortunately, previous approaches only provide a level of security against software-based attacks and leave the system wide open to hardware attacks. This dissertation thesis proposes six design methodologies to shield a uniprocessor or a multiprocessor system against a various number of Denial of Service (DoS) attacks at the architectural and the operating system level. Specific focus is given to the memory subsystem (i.e. cache memories). The cache memories account for a large portion of the silicon area, they are greedy power consumers and they seriously determine system performance due to the even growing gap between the processor speed and main memory access latency. As a result, in this thesis we propose methodologies to optimize the functionality and lower the power consumption of the cache memories. The goal in all cases is to increase the performance of the system, the achieved packet throughput and to enhance the protection against a various number of passive and Denial of Service attacks.

In a traditional business environment, companies set up their organisation’s IT data infrastructure, install their applications and carry out the maintenance and management of their infrastructures. Whereas Cloud computing removes the need for companies to set up own data centers and run enterprise applications. Cloud computing technology provides businesses with the advantage of on-demand access, agility, scalability, flexibility and reduced cost of computing. An appreciable increase is being observed in the acceptance and migration to this new IT model in developing economies. In Nigeria, it has been observed that there is a somewhat unimpressive rate of adoption of Cloud computing by the microfinance operators. This research investigates the reason for the slow adoption of Cloud computing by SMEs in Nigeria with special consideration to the Microfinance subsector and to develop a model for improving the adoption of cloud computing by microfinance organisations. The research was conducted using a qualitative research design method. Interview was the main data collection instrument and data collected was analysed using thematic content analysis method. The analysis of the study revealed that SMEs in Nigeria, with particular reference to microfinance subsector in Akwa Ibom State are yet fully to embrace cloud technology. It was discovered that most of the SMEs studied, has some level of reservation about cloud computing arising from not having appropriate education and enlightenment about the cloud economic offerings and potentials. From the outcome of the research, the researcher identified that most people’s concerns are as a result of lack of knowledge about cloud computing and so the researcher concluded that appropriate enlightenment by industry stakeholders, cloud service providers, cloud enthusiasts and even the government on the risks and overwhelming economic incentives of cloud computing as well as the provision of a monitored free trial services will encourage the adoption of cloud computing by SMEs. / College of Engineering, Science and Technology / M.Tech. (Information Technology)

Private set intersection(PSI) is a two party protocol where both parties possess a private set and at the end of the protocol, one party (client) learns the intersection while other party (server) learns nothing. Motivated by some interesting practical applications, several provably secure and efficient PSI protocols have appeared in the literature in recent past. Some of the proposed solutions are secure in the honest-but-curious (HbC) model while the others are secure in the (stronger) malicious model. Security in the latter is traditionally achieved by following the classical approach of attaching a zero knowledge proof of knowledge (ZKPoK) (and/or using the so-called cut-and-choose technique). These approaches prevent the parties from deviating from normal protocol execution, albeit with significant computational overhead and increased complexity in the security argument, which includes incase of ZKPoK, knowledge extraction through rewinding. We critically investigate a subset of the existing protocols. Our study reveals some interesting points about the so-called provable security guarantee of some of the proposed solutions. Surprisingly, we point out some gaps in the security argument of several protocols. We also discuss an attack on a protocol when executed multiple times between the same client and server. The attack, in fact, indicates some limitation in the existing security definition of PSI. On the positive side, we show how to correct the security argument for the above mentioned protocols and show that in the HbC model the security can be based on some standard computational assumption like RSA and Gap Diffie-Hellman problem. For a protocol, we give improved version of that protocol and prove security in the HbC model under standard computational assumption. For the malicious model, we construct two PSI protocols using deterministic blind signatures i.e., Boldyreva’s blind signature and Chaum’s blind signature, which do not involve ZKPoK or cut-and-choose technique. Chaum’s blind signature gives a new protocol in the RSA setting and Boldyreva’s blind signature gives protocol in gap Diffie-Hellman setting which is quite similar to an existing protocol but it is efficient and does not involve ZKPoK.