Background: The network-centric defense requires a method for securing vast dynamic distributed information systems. Currently, there are no efficient methods for establishing the level of IT security in vast dynamic distributed information systems. Purpose: The target of this thesis was to design a method, capable of determining the level of IT security of vast dynamic component-based distributed information systems. Method: The work was carried out by first defining concepts of IT security and distributed information systems and by reviewing basic measurement and modeling theory. Thereafter, previous evaluation methods aimed at determining the level of IT security of distributed information systems were reviewed. Last, by using the theoretic foundation and the ideas from reviewed efforts, a new evaluation method, aimed at determining the level of IT security of vast dynamic component-based distributed information systems, was developed. Results: This thesis outlines a new method, CAESAR, capable of predicting the security level in parts of, or an entire, component-based distributed information system. The CAESAR method consists of a modeling technique and an evaluation algorithm. In addition, a Microsoft Windows compliant software, ROME, which allows the user to easily model and evaluate distributed systems using the CAESAR method, is made available.

Hundreds of millions of people use their home computers every day for different purposes. Many of them are connected to the Internet. Most of them are unaware of the threats or do not know how to protect themselves. This unawareness is a major threat to global computer security. This master thesis starts by explaining some security related terms that might be unknown to the reader. It then goes on by addressing security vulnerabilities and flaws in the most popular home computer operating systems. The most important threats to home computer security are reviewed in the following chapter. These threats include worms, email worms, spyware and trojan horses. After this chapter some possible solutions for improving home computer security are presented. Finally this master thesis contains a short user survey to find out what the problems are in the real world and what can be doneto improve the current situation.

Uppsatsen behandlar användandet av geografiska informationssystem (GIS) i två kommuner. Jag har valt att studera Stenungsunds och Trollhättans kommun, på grund av att de använder GIS olika mycket och har kommit olika lång i utvecklingen av GIS-användandet i kommunen. Studien genomförs som en flerfallsstudie och informationskällorna är intervjuer, observationer och olikaformer av dokument. Mycket av den information som hanteras av kommuner kan skötas med stöd av GIS och jag vill med denna uppsats visa vilken användning två olika kommuner har av GIS. GIS började användas i större utsträckning under 1980- och 1990-talen och med hjälp av GIS kan olika sorters information kopplas samman och ge resultat och beslutsunderlag som annars hade varit svåra att ta fram. Det finns undersökningar som visar på att investeringar i GIS ofta kan generera vinster som är fyra gånger större än det investerade kapitalet. För att GIS ska fungera väl i en organisation måste lika mycket tid, planering och kapital läggas på expertis, data, organisation samt hård och mjukvara. Uppsatsen beskriver vad GIS är, består av och vad som kan åstadkommas med hjälp av GIS. Uppsatsen visar att GIS bör integreras väl i en organisation för att fungera tillfredställande.

The convergence of future networks relies on the evolution of technology that enables seamless roaming abilities across non-heterogenous networks for mobile clients. This thesis presents an experimental study of a GPRS-WLAN integration scenario where the objective is to analyze various aspects of the issues related to charging, mobility, roaming and security between GPRS and WLAN networks. The mainly discussed integration scenario in this thesis is loosely coupled systems working on RADIUS platforms, which together with MobileIP and IPSec provides the mobile client with a secure and access-technology independent network access platform. In order to accommodate GPRS client authentication for WLAN operators, there is a prominent need for the incorporation of necessary GPRS functionality into present AAA servers. RADIUS has been studied as the initial target for the implementation of a GPRS interface towards SMS-Cs and HLRs.The authentication of a mobile client is performed against a HLR/AuC in a GPRS network, either over SS7 links or through the incorporation of SIGTRAN protocols over SCTP. SIGTRANsolutions has the ability to join WLAN networks in a SS7 resource sharing model where the SS7 authentication signalling traffic is transported over IP networks to a Signalling Gateway acting as the logical interface against SS7 networks. GPRS-WLAN accounting may be solved through direct roaming agreements between mobile operators and in such a case transport CDR’s over FTP between their billing systems. If roaming agreements does not exist, it may be viable to establish relationships between WLANs and brokers as well as mobile operators and brokers. The brokering model provides a scalable model that allows easier exchange of charging and billing information on an infrastructure based on WLAN and GPRS billing systems. Standardised transmission protocols for accounting information such as GTP’/TAP3 may be utilised in order to provide a generic billing exchange format between billing systems and operators. Furthermore, different network architectures may have different requirements in order to accommodate GPRS clients with WLAN access. A few network architectures has been analysed, and the developed GPRS AAA Interface Daemon (GAID) has been put into context in order to present a generic GPRS-WLAN systems integration solution for WLAN operators. The analysed solutions in this thesis give various possibilities for WLAN operators to setup wireless services for bypassing mobile clients. The implementational work provides a RADIUS platform, which can be enhanced with functionality that enables communication over any interface in the future.

With the development of the Internet, illegal copying of electronic documents has become a growing problem. There is an increasing need of prevention in the field of pirate copying. One method is to mark the document by changing some of the words to synonyms. In this way it is possible to construct legal copies which do not differ in content but still are unique. Since the copies of the documents are unique, it is possible to trace the owner of a document and accordingly call him or her to account for pirate copying if several exactly similar copies are reaching the market. The aim of this study was to investigate the possibility of exchanging words for synonyms in a text from a work of fiction, examining both the literary qualities of the manipulated texts and the security aspect. The conclusion of the study is that it is possible to mark texts of imaginative literature by means of the use of synonyms.

E-books have a wide range of application spheres from rich-media presentations to web site archiving, from writing to financial statement. They make publishing, storing and distributing of information quite simple. As a new publication technique, the main concern with e-books is the copyright infringement. To prevent e-books from free duplication and distribution, different security mechanisms are used in their publishing and distributing processes. By investigating and analyzing Digital Rights Management (DRM) and Electronic Book Exchange (EBX), this thesis presents some security issues that the e-book industry are or should be aware. Various security problems and possible solutions are highlighted by means of two case studies.

Att använda sig av IT-outsourcing är en fråga som allt fler börjar fundera kring. Givetvis finns det inte ett sätt som är lämpligt för alla företag. Beroende på vilka behov och förutsättningar som finns inom en organisation kan därför olika former eller grader av IT?outsourcing användas. Vid ett eventuellt beslut så är det dock viktigt att beslutsfattarna inte enbart ser till de fördelar som kan vinnas utan också se till de nackdelar som kan följa med ett sådant beslut. Undersökningen som gjorts i rapporten tar upp dessa för- och nackdelar samt visar hur de två Motalaföretagen Autoliv electronics AB och AB Electrolux använder sig av IT-outsourcing. Formen och graden av deras IT-outsourcing skiljer sig mycket åt medan de för- och nackdelar som nämns av de fyra intervjuade till mångt och mycket liknar varandra. Fördelarna överväger dock enligt de båda företagen då bland annat flexibiliteten ökar vad gäller bemanning och kompetens.

The aim of this report is to examine if existing Digital Rights Management systems are useful and satisfying to the consumer, copyright owner and distributor. If not, is it possible to design a useful and satisfying Digital Rights Management system? During the past few years, copyright owners of music, movies and other media have seen how piracy has increased with the introduction of affordable broadband technology. Record and movie corporations have pushed for a solution to piracy and one of them is Digital Rights Management. They want their customers to pay for and then enjoy the digital media but at the same time protect the rights of the copyright owner. That is what Digital Rights Management is all about; protect the copyright owner while allowing the consumer to enjoy their digital media. Digital Rights Management can restrict the users rights to copy and transfer the contents to other devices as well as restrict the number of times a user is allowed to use the media. The present DRM systems are focusing on preventing digital media from being freely distributed by limiting the ability to copy or move the media. This puts limitations on fair use such as making personal copies of music. Copyright owners and distributors want more consumers to discover DRM, but so far, the consumers have shown little interest. This report is based on various resources on the Internet such as white papers on Digital Rights Management, our own experimentation and on Microsoft Media Rights Management SDK documentation. We do not believe it is possible to design a DRM system that consumers, copyright owners and distributors are satisfied with. It is not possible to combine the demands of copyright owners and the consumers’ claims of fair use.

This thesis suggests a security evaluation framework for distributed information systems, responsible for generating a system modelling technique and an evaluation method. The framework is flexible and divides the problem space into smaller, more accomplishable subtasks with the means to focus on specific problems, aspects or system scopes. The information system is modelled by dividing it into increasingly smaller parts, evaluate the separate parts and then build up the system “bottom up” by combining the components. Evaluated components are stored as reusable instances in a component library. The evaluation method is focusing on technological components and is based on the Security Functional Requirements (SFR) of the Common Criteria. The method consists of the following steps: (1) define several security values with different aspects, to get variable evaluations (2) change and establish the set of SFR to fit the thesis, (3) interpret evaluated security functions, and possibly translate them to CIA or PDR, (4) map characteristics from system components to SFR and (5) combine evaluated components into an evaluated subsystem. An ontology is used to, in a versatile and dynamic way, structure the taxonomy and relations of the system components, the security functions, the security values and the risk handling. It is also a step towards defining a common terminology for IT security.

IEEE 802.11 [1]is the standard that has emerged as a prevailing technology for the wireless local area networks. It can be considered the wireless version of Ethernet, which supports best-effortservice. IEEE is developing a new standard called 802.11e to be able to provide quality of service (QoS) in WLANs. Two possible methods have been proposed in [3]in order to improve the performance of service differentiation in the MAC layer. They are called PCWA (Practical Contention Window Adjustment) and AIPM (Adaptive Initiative Polling Machine). In this thesis, I will analyse both methods and propose new ideas to improve their performance, simulating the ideas concerning PCWA. Simulations show better general performance, especially for highest priorities flows, although the behaviour of the lowest priority one is reduced.