No description available.

For integration between application-systems in a global context, interoperability needs to be established on a global level; global interoperability, in turn, is based on a global common application-interface. This is achieved through resolving differences in, inter alia, protocol profiles, among participants in the global network. ebXML is used as the point of departure. A messaging framework, which is based on existing Web technology and standards, is proposed. Certain security and Web service standards are examined to determine specific parameters for an interoperable secure messaging environment. A security based framework comprising a predefined message format and architecture is investigated for a secure interoperable global electronic marketspace.

M.Tech. / Mobile handheld devices are moving from being peripheral devices and are now fulfilling functionality provided by laptops and desktops. The capability and functionality of handheld devices have improved. This makes the devices more prominent within public and private environments, allowing information to be processed inside and outside of the organisation’s network. Of all mobile handheld devices, the personal digital assistant (PDA) is seen to be more robust and powerful, increasing its use and popularity among users. PDAs offer wireless connectivity like Bluetooth and operate with multiple operating systems, also allowing them to be considered as a private or organisational enterprise tool. Bluetooth connectivity allows workers to access information anywhere, including both personal and corporate information. Software and applications have been specifically developed for handheld devices such as PDAs, giving users a high level of usability and functionality. The purpose of this dissertation is to present an information security evaluation of a Bluetooth-enabled handheld device, such as a PDA. The use of Bluetooth wireless technology and functionality provides added benefits, but also brings new information security threats to an organisation’s information assets. The research attempts to understand the implications of using a Bluetooth-enabled handheld device in both public and private environments. Five high-level layers are defined for this discussion. Information security risks are evaluated based on current research into vulnerabilities, attacks and tools that exist to compromise a Bluetooth-enabled handheld device. A Bluetooth penetration testing methodology is suggested for the identified vulnerabilities, attacks and tools, where a practical assessment is performed for a critical analysis of the information security mechanisms implemented by the Bluetooth-enabled handheld device (PDA). Possible recommendations to mitigate identified information security risks are also made. This study motivates the necessity of understanding the risks presented by a mobile workforce using Bluetooth connectivity in mobile handheld devices which can be used in both private and public environments.

在信息傳輸過程中如何保證信息的安全性是通信中的重要問題之一。目前常用的保密傳輸方式是基於密鑰的加密技術，但是隨著現代無線通信網絡的發展和計算資源的不斷豐富，基於密鑰的技術在無線網絡中的應用正面臨着巨大挑戰。這些挑戰一方面來自於無線介質的開放性使得竊聽更為容易，另一方面由於動態無線網絡和自組織無線網絡的發展使得密鑰的發布和管理更為困難。因此，為解決密鑰技術所面臨的挑戰，基於物理層的保密傳輸技術研究在近些年受到了很大關注。該技術最早在七十年代由Wyner 提出，其核心思想是利用無線信道的隨機性和目標用戶與竊聽者間無線信道容量的差異，通過對發射信號進行編碼設計使得目標用戶能正確解碼信息但竊聽者卻不能。該技術的關鍵問題之一是如何對發射信號進行設計從而提高保密信息的傳輸速率（或保密容量）。本論文的主要工作即是以此出發，旨在研究不同通信場景下最優化發射信號的設計，具體而言，本論文主要研究了以下場景下的最優發射信號設計： / 本論文的第一部分考慮一個多天線的發射機傳輸保密信息給一個單天線的目標用戶，同時有多個多天線的偷聽者在偷聽的場景。我們的目標是設計最優化發射信號使得保密信息傳輸速率最大化。該優化問題的難點在於保密信息速率函數是發射信號的一個非凸函數，因而很難求解到全局最優解。我們通過運用凸鬆弛技術證明這個非凸優化問題的全局最優解可以由它的凸鬆弛問題得到，並且我們證明了最優化的發射信號方案是採用波束聚焦。以上結論在發射機完全知道和部分知道接收機的信道信息時均成立。 / 本論文的第二部分是在第一部分的基礎上考慮在發射信號中加入人為噪聲以輔助保密信息的傳輸。具體而言，發射機可以分配部分功率來發射人為噪聲以達到干擾竊聽者的接收的目的。儘管在現有很多研究中已經證明了這種人為噪聲輔助的發射方式可有效提高保密信息傳輸速率，但是如何對保密信號和人為噪聲進行聯合優化設計使得保密傳輸速率最大化的問題一直未能有效解決。在本論文中，我們給出了一種保密信號和人為噪聲聯合最優化的求解方案。該方案是基於優化理論中的半正定規劃算法來獲得全局最優解，並且該算法在發射機完全知道和部分知道接收機信道信息時均適用。 / 本論文的第三部分主要考慮的是發射機、目標用戶和偷聽者均是多天線情況下，最大化保密信息容量的發射信號設計問題。該優化問題可以看作是之前單天線目標用戶的一個推廣，但較之前的最優信號設計問題更加具有挑戰性。在目前已知的工作中，該優化問題還沒有一個有效的多項式時間算法能求解到全局最優解。這裡，我們提出了一種基於交替優化算法的發射信號設計方案來獲得（局部）最優發射信號設計。我們證明該交替優化算法可以通過迭代注水算法來實現，因而具有很低的複雜度，並且該算法可以保證收斂到原最優化問題的穩定點，因而可以在多數情況下獲得（局部）最優解。同時在該部分，我們也研究了在發射機部分知道信道信息狀態時魯棒性發射信號的設計問題，並給出了基於交替優化算法的魯棒發射信號設計。 / 除以上提到的主要結果，本論文還考慮了多播保密信息速率最優化發射信號設計，和具有中斷概率約束的保密信息速率最優化發射信號的設計。 / Security is one of the most important issues in communications. Conventional techniques for achieving confidentiality in communication networks are based on cryptographic encryption. However, for wireless networks, this technique is faced with more challenges due to the open nature of the wireless medium as well as the dynamic topology of mobile networks. In the 1970's, Wyner proposed a physical layer-based approach to achieve perfectly secure communication without using encryption. One of the key problems of Wyner's approach is how to optimally design the transmit signal such that a high secrecy rate (i.e., the data rate at which the confidential information can be securely transmitted) can be achieved. In our work, we aim to solve this transmit signal optimization problem under various scenarios using convex optimization techniques. Specifically, the thesis consists of the following three main parts: / In the first part, we consider a multi-input single-output (MISO) scenario, where a multi-antenna transmitter sends confidential information to a singleantenna legitimate receiver, in the presence of multiple multi-antenna eavesdroppers. Our goal is to maximize an achievable secrecy rate by appropriately designing the transmit signal. The challenge of this secrecy rate maximization (SRM) problem is that it is a nonconvex optimization problem by nature. We show, by convex relaxation, that this seemingly nonconvex SRM problem admits a convex equivalent under both perfect and imperfect channel state information (CSI) cases. Our result also indicates that transmit beamforming is an optimal transmit strategy, irrespective of the number of eavesdroppers and the number of antennas employed by each eavesdropper. This provides a useful design guideline for practical implementations. / In the second part, we consider a scenario where the transmitter is able to simultaneously generate artificial noise (AN) to interfere the eavesdroppers during the transmission of the confidential message. While the efficacy of AN in improving the system security has been demonstrated in many existing works, how to jointly optimize the AN and the transmit signal is still an unsolved problem. In this part, we solve this AN-aided SRM problem under the same scenario as the first part, and give an efficient, semidefinite program (SDP)- based line search approach to obtain an optimal transmit signal and AN design under both perfect and imperfect-CSI situations. / In the last part, we consider a secrecy capacity maximization (SCM) problem for a multi-input multi-output (MIMO) scenario, where the legitimate receiver and the eavesdropper are both equipped with multiple antennas. This MIMOSCM problem is a generalization of the previous MISO-SRM problems. So far there is no known efficient algorithm to solve this problem in a global optimal manner. Herein, we propose an alternating optimization algorithm to tackle the SCM problem. The proposed algorithm has a nice iterative water-filling interpretation and is guaranteed to converge to a stationary solution of the MIMO-SCM problem. Extensions to robust SCM are also investigated in this part. / Besides the above three main results, this thesis also developed some approximate solutions to the multicast SRM of multiple MISO legitimate channels overheard by multiple MIMO eavesdroppers, and to the outage-constrained SRM of an MISO legitimate channel overheard by multiple MISO eavesdroppers. / Detailed summary in vernacular field only. / Detailed summary in vernacular field only. / Detailed summary in vernacular field only. / Detailed summary in vernacular field only. / Detailed summary in vernacular field only. / Li, Qiang. / Thesis (Ph.D.)--Chinese University of Hong Kong, 2012. / Includes bibliographical references. / Electronic reproduction. Hong Kong : Chinese University of Hong Kong, [2012] System requirements: Adobe Acrobat Reader. Available via World Wide Web. / Abstract also in Chinese. / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Contributions of This Thesis --- p.3 / Chapter 1.2 --- Organization of This Thesis --- p.5 / Chapter 2 --- Fundamentals of Physical-Layer Secrecy --- p.6 / Chapter 2.1 --- Elements of Information Theoretic Security --- p.6 / Chapter 2.2 --- Transmit Design for Physical-layer Secrecy: State-of-the-Art --- p.14 / Chapter 2.2.1 --- MISO Secrecy Capacity Maximization --- p.14 / Chapter 2.2.2 --- MIMO Secrecy Capacity Maximization --- p.17 / Chapter 2.2.3 --- AN-aided Secrecy Rate Maximization --- p.21 / Chapter 2.2.4 --- Secrecy Rate Maximization with Additional Covariance Constraints --- p.24 / Chapter 2.2.5 --- Robust Transmit Design for Physical-Layer Secrecy under Imperfect CSI --- p.28 / Chapter 2.3 --- Summary --- p.36 / Chapter 2.4 --- Appendix: GSVD --- p.37 / Chapter 3 --- MISOMEs Secrecy Rate Maximization --- p.38 / Chapter 3.1 --- System Model and Problem Statement --- p.39 / Chapter 3.1.1 --- System Model --- p.39 / Chapter 3.1.2 --- Problem Statement --- p.40 / Chapter 3.2 --- An SDP Approach to SRM Problem (3.4) --- p.43 / Chapter 3.2.1 --- The Secrecy-Rate Constrained Problem --- p.44 / Chapter 3.2.2 --- The Secrecy-Rate Maximization Problem --- p.46 / Chapter 3.3 --- Secrecy-Rate Optimization with Imperfect CSI --- p.49 / Chapter 3.3.1 --- Robust Secrecy-Rate Problem Formulations --- p.49 / Chapter 3.3.2 --- The Robust Secrecy-Rate Constrained Problem --- p.50 / Chapter 3.3.3 --- The Robust Secrecy-Rate Maximization Problem --- p.53 / Chapter 3.4 --- Simulation Results --- p.55 / Chapter 3.4.1 --- The Perfect CSI Case --- p.56 / Chapter 3.4.2 --- The Imperfect CSI Case --- p.58 / Chapter 3.5 --- Summary --- p.59 / Chapter 3.6 --- Appendix --- p.61 / Chapter 3.6.1 --- Proof of Proposition 3.1 --- p.61 / Chapter 3.6.2 --- Verifying Slater's Constraint Qualification for Problem (3.10) --- p.63 / Chapter 3.6.3 --- Proof of Theorem 3.1 --- p.63 / Chapter 3.6.4 --- Relationship between Super-Eve Design and the Optimal SDP Design --- p.65 / Chapter 3.6.5 --- Proof of Proposition 3.4 --- p.67 / Chapter 3.6.6 --- Proof of Proposition 3.5 --- p.70 / Chapter 3.6.7 --- Worst-case Secrecy Rate Calculation --- p.71 / Chapter 4 --- Multicast Secrecy Rate Maximization --- p.73 / Chapter 4.1 --- System Model and Problem Statement --- p.74 / Chapter 4.2 --- An SDP Approximation to Problem (4.2) --- p.75 / Chapter 4.3 --- Simulation Results --- p.78 / Chapter 4.4 --- Summary --- p.79 / Chapter 4.5 --- Appendix --- p.81 / Chapter 4.5.1 --- Proof of Proposition 4.1 --- p.81 / Chapter 4.5.2 --- Proof of Theorem 4.1 --- p.82 / Chapter 5 --- AN-aided MISOMEs Secrecy Rate Maximization --- p.85 / Chapter 5.1 --- System Model and Problem Statement --- p.86 / Chapter 5.1.1 --- System Model --- p.86 / Chapter 5.1.2 --- Problem Statement --- p.87 / Chapter 5.2 --- An SDP-based Approach to the SRM Problem --- p.89 / Chapter 5.2.1 --- A Tight Relaxation of the SRM Problem (5.4) --- p.90 / Chapter 5.2.2 --- An SDP-based Line Search Method for the Relaxed SRM Problem (5.9) --- p.92 / Chapter 5.3 --- Robust Transmit Design for Worst-Case SRM --- p.94 / Chapter 5.3.1 --- Worst-Case Robust SRM Problem Formulation --- p.95 / Chapter 5.3.2 --- A Tight Relaxation of the WCR-SRM Problem (5.17) --- p.96 / Chapter 5.3.3 --- An SDP-based Line Search Method for the RelaxedWCRSRM Problem (5.23) --- p.98 / Chapter 5.4 --- Robust Transmit Design for Outage SRM --- p.100 / Chapter 5.4.1 --- A Sphere-bounding Safe Approximation to OCR-SRM Problem (5.29) --- p.101 / Chapter 5.5 --- Simulation Results --- p.103 / Chapter 5.5.1 --- The Perfect-CSI Case --- p.104 / Chapter 5.5.2 --- The Imperfect-CSI: Bounded Spherical Uncertainty --- p.105 / Chapter 5.5.3 --- The Imperfect-CSI: Gaussian Random Uncertainty --- p.108 / Chapter 5.6 --- Summary --- p.111 / Chapter 5.7 --- Appendix --- p.112 / Chapter 5.7.1 --- Proof of Proposition 5.1 --- p.112 / Chapter 5.7.2 --- Proof of Theorem 5.1 --- p.114 / Chapter 5.7.3 --- Proof of Theorem 5.2 --- p.117 / Chapter 6 --- Outage Secrecy Rate Maximization for MISOSEs --- p.120 / Chapter 6.1 --- System Model and Problem Statement --- p.121 / Chapter 6.2 --- A Bernstein-type Inequality-Based Safe Approximation to Problem (6.2) --- p.122 / Chapter 6.3 --- Simulation Results --- p.127 / Chapter 6.4 --- Summary --- p.128 / Chapter 6.5 --- Appendix --- p.129 / Chapter 6.5.1 --- Proof of Lemma 6.1 --- p.129 / Chapter 6.5.2 --- Proof of Proposition 6.1 --- p.130 / Chapter 7 --- MIMOME Secrecy Rate Maximization --- p.134 / Chapter 7.1 --- An Alternating Optimization Approach to the MIMO-SCM Problem (7.1) --- p.135 / Chapter 7.2 --- An Alternating Optimization Approach to theWorst-case MIMOSCM Problem --- p.140 / Chapter 7.3 --- An Alternating Optimization Approach to the Outageconstrained SCM --- p.142 / Chapter 7.4 --- Simulation Results --- p.145 / Chapter 7.4.1 --- The Perfect CSI Case --- p.146 / Chapter 7.4.2 --- The Imperfect CSI case --- p.149 / Chapter 7.5 --- Summary --- p.150 / Chapter 7.6 --- Appendix --- p.153 / Chapter 7.6.1 --- Proof of Proposition 7.1 --- p.153 / Chapter 7.6.2 --- Proof of the monotonicity of Tr(W? ) w.r.t. --- p.154 / Chapter 7.6.3 --- Proof of Proposition 7.2 --- p.155 / Chapter 8 --- Conclusion --- p.157 / Chapter 8.1 --- Summary --- p.157 / Chapter 8.2 --- Future Directions --- p.158 / Bibliography --- p.161

There have been decades of attempts to evolve or revolutionise the traditional financial system, but not all such efforts have been transformative or even successful. From Chaum's proposals in the 1980s for private payment systems to micropayments, previous attempts failed to take off for a variety of reasons, including non-existing markets, or issues pertaining to usability, scalability and performance, resilience against failure, and complexity of protocols. Towards creating more resilient payment systems, we investigated issues related to security engineering in general, and payment systems in particular. We identified that network coverage, central points of failure, and attacks may cripple system performance. The premise of our research is that offline capabilities are required to produce resilience in critical systems. We focus on issues related to network problems and attacks, system resilience, and scalability by introducing the ability to process payments offline without relying on the availability of network coverage; a lack of network coverage renders some payment services unusable for their customers. Decentralising payment verification, and outsourcing some operations to users, alleviates the burden of contacting centralised systems to process every transaction. Our secondary goal is to minimise the cost of providing payment systems, so providers can cut transaction fees. Moreover, by decentralising payment verification that can be performed offline, we increase system resilience, and seamlessly maintain offline operations until a system is back online. We also use tamper-resistant hardware to tackle usability issues, by minimising cognitive overhead and helping users to correctly handle critical data, minimising the risks of data theft and tampering. We apply our research towards extending financial inclusion efforts, since the issues discussed above must be solved to extend mobile payments to the poorest demographics. More research is needed to integrate online payments, offline payments, and delay-tolerant networking. This research extends and enhances not only payment systems, but other electronically-enabled services from pay-as-you-go solar panels to agricultural subsidies and payments from aid donors. We hope that this thesis is helpful for researchers, protocol designers, and policy makers interested in creating resilient payment systems by assisting them in financial inclusion efforts.

This thesis explores the security of intermittent devices, embedded systems designed to retain their state across periods of power loss, for cases both when the device has an excess of available energy and when power loss is unavoidable. Existing work with intermittent systems has focused on the problems inherent to the intermittent paradigm and ignored the security implications of persistent state across periods of power loss. The security of these devices is closely linked to their unique operational characteristics and are addressed here in two studies. First, the presence of an energy harvester creates an opportunity to use excess energy, available when additional energy is harvested after the local energy reservoir is filled, to precompute security related operations. Precomputation powered by this excess energy can reduce the cost of expensive tasks during periods of energy scarcity, potentially enabling the use of expensive security operations on traditionally unsecured devices. Second, when energy is limited and intermittent operation is required, the secure storage of checkpoints is a necessity to protect against adversary manipulation of the system state. To examine the secure storage of checkpoints a protocol is implemented to ensure the integrity and authenticity of a device's checkpoints, and evaluated for its energy overhead and performance. The cost of properly ensuring the integrity and authenticity of these checkpoints is examined to identify the overhead necessary to execute intermittent operations in a secure manner. Taken together, these studies lay the groundwork for a comprehensive view of the current state of intermittent device security. / Master of Science / This thesis explores two unique aspects of the intermittent computing paradigm, the precomputation during periods of excess energy and the security of system checkpoints. Intermittent systems are a class of embedded device that lack a classic, consistent, energy source and instead rely on transient energy collected from their surroundings. This removes the need for connection to a power grid or battery management, but introduces challenges in operation since the device can lose power at any time. Additionally, excess energy is available to these systems when they have filled their local energy reservoir, a capacitor or small rechargeable battery, and additional energy can still be collected form the environment. In this case, it is possible to begin precomputing energy intensive operations to enable more operations at a later time on a limited energy budget. Since their power source is inconsistent, intermittent systems checkpoint their current state to allow execution to resume at the beginning of the next power cycle. The security ramifications of saving the current system state into a checkpoint have not been considered in the state of the art. This thesis implements a protocol to properly secure system checkpoints and evaluates its performance to identify the energy overhead required for a secure checkpointing scheme. The results demonstrate the need for the development of more efficient solutions within the domain. Together, the two approaches presented in this thesis provide case studies on the behavior of intermittent devices when provided with either an excess or a dearth of energy. The optimization and improvement of modern intermittent devices will need to address both of these extremes as the field is further improved.

Abstract When implementing their information security solutions organizations have typically focused on technical and procedural security measures. However, from the information systems (IS) point of view, this is not enough: effective IS security requires that users are aware of and use the available security measures as described in their organizations' information security policies and instructions. Otherwise, the usefulness of the security measures is lost. The research question of this thesis is to explore how IS users' compliance with IS security policies and instructions can be improved. Solving this research question is divided into two steps. Since there is a lack of a comprehensive review of existing IS security awareness approaches, the first step aims at reviewing the existing IS security awareness approaches. This kind of analysis is useful for practitioners as they do not necessarily have the time to go through a large body of literature. For scholars, such an analysis shows what areas of IS security awareness have been studied, and to where the need for future research is of greatest importance. The second step in this dissertation is to address the shortcomings detected by the analysis by developing three novel design theories for improving IS users' security behavior: (1) IS security awareness training, (2) IS security awareness campaigns, and (3) punishment and reward. These design theories aim to help practitioners to develop their own IS security awareness approaches. Finally, testing of the design theory for IS security awareness training (1) in two action research interventions is described. The results of the interventions suggest that this design theory provides a useful and applicable means for developing a training program in organizations. In addition, the results provide empirically evaluated information regarding the obstacles to user compliance with IS security policies and instructions. In the action research studies described, the goal was to solve practical problems experienced by the host organizations and to understand them and the results achieved from the viewpoint of theory. Consequently, the results as such can not be generalized, but they are of use in the host organizations in planning and delivering subsequent IS security awareness training programs. In addition, the results are utilizable in similar organizations as a point of departure in planning IS security awareness training programs.

Abstract Employee non-compliance with information systems (IS) security procedures is a key concern for organizations. However, even though the importance of having effective IS security training is widely acknowledged by scholars and practitioners, the existing literature does not offer an understanding of the elementary characteristics of IS security training, nor does it explain how these elementary characteristics shape IS security training principles in practice. To this end, this thesis develops a theory that suggests that IS security training has certain elementary characteristics that separate it from other forms of training, and sets a fundamental direction for IS security training practices. Second, the theory defines four pedagogical requirements for designing IS security training approaches. Then it points out that no existing IS security training approaches meet all these requirements. To address these shortcomings, the way in which to design an IS security training approach that meets all these requirements is demonstrated. In this thesis it is also argued that, along with an effective IS security training approach, reasons for employees’ IS security behavior need to be understood. The existing empirical research in the field of employees’ IS security behavior is dominated by theory-verification studies that test well-known theories developed in other fields in the context of IS security. Instead, it is argued that there is a need to focus the investigation on the phenomenon of employees’ compliance itself through an inductive and qualitative approach to complement the existing body of knowledge of this topic. As a result, a framework identifying reasons associated with compliance/non-compliance with security procedures is developed. A particularly interesting finding is that individuals’ violation of IS security procedures depends on the type of violation. Besides advancing a meta-theory for IS security training and developing the theoretical framework that points out reasons for employees’ IS security behavior, the thesis provides a future research agenda for IS security training and behavior. For practitioners, this thesis points out the limitations of the previous IS security training approaches and reasons for IS security behavior and, based on these observations, offers principles for designing effective IS security training approaches in practice. / Tiivistelmä Yhtenä keskeisenä ongelmana organisaatioissa pidetään sitä, että työntekijät laiminlyövät organisaation tietoturvakäytäntöjä. Vaikka tutkijat ja organisaatiot ovat tunnistaneet tietoturvakoulutuksen tärkeyden, olemassa oleva kirjallisuus ei tuo esiin tietoturvakoulutuksen perusominaisuuksia ja niiden asettamia vaatimuksia käytännön tietoturvakoulutukselle. Tässä väitöskirjassa kehitetään kolmitasoinen meta-teoria, joka huomioi nämä aikaisemmasta tietoturvakoulutusta käsittelevästä kirjallisuudesta puuttuvat kysymykset. Teorian ensimmäisellä tasolla määritellään tietoturvakoulutuksen perusominaisuudet, jotka erottavat sen muista koulutusmuodoista ja ohjaavat tietoturvakoulutuksen toteuttamista käytännössä. Teorian toisella tasolla määritellään neljä pedagogista vaatimusta tietoturvakoulutuksen suunnitteluun. Lisäksi kirjallisuusanalyysin perusteella osoitetaan, että olemassa oleva tietoturvakoulutusta käsittelevä kirjallisuus ei täytä kaikkia näitä vaatimuksia. Teorian kolmannella tasolla esitetään käytännön esimerkki siitä, kuinka tietoturvakoulutus voi täyttää tutkimuksessa määritellyt pedagogiset vaatimukset. Väitöskirjassa esitetään myös, että tehokkaan koulutusmenetelmän lisäksi on tärkeää ymmärtää työntekijöiden tietoturvakäyttäytymistä. Aikaisemmin tällä alueella on pääasiassa testattu muiden tieteenalojen teorioita tietoturvakontekstissa. Tässä väitöskirjassa sen sijaan tarkastellaan työntekijöiden tietoturvakäyttäytymisen syitä induktiivisen ja laadullisen tutkimusmenetelmän avulla. Tutkimuksen tuloksena kehitetään teoreettinen viitekehys, jonka avulla analysoidaan työntekijöiden tietoturvakäyttäytymistä. Tutkimuksen päätuloksena osoitetaan, kuinka tietoturvakäyttäytymiseen syyt eroavat rikkomustyypeittäin. Tietoturvakoulutuksen suunnittelua tukevan meta-teorian ja työntekijöiden tietoturvakäyttäytymistä selittävän teoreettisen viitekehyksen lisäksi väitöskirjassa esitetään uusia näkökulmia tietoturvakoulutuksen ja tietoturvakäyttäytymisen tutkimukselle. Käytännön tietoturva-ammattilaisille väitöskirja selventää olemassa olevien tietoturvakoulutuksen lähestymistapojen puutteita ja syitä työntekijöiden tietoturvakäyttäytymiselle. Näihin havaintoihin perustuen väitöskirjassa esitetään tekijöitä, joita tietoturvakoulutuksessa tulisi käytännössä ottaa huomioon.

Chan Pik-Wah. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2004. / Includes bibliographical references (leaves 111-130). / Abstracts in English and Chinese. / Abstract --- p.i / Acknowledgement --- p.iv / Chapter 1 --- Introduction --- p.1 / Chapter 1.1 --- Background --- p.1 / Chapter 1.2 --- Research Objective --- p.3 / Chapter 1.3 --- Contributions --- p.4 / Chapter 1.4 --- The Structure of this Thesis --- p.6 / Chapter 2 --- Literature Review --- p.7 / Chapter 2.1 --- Security in Multimedia Communications --- p.8 / Chapter 2.2 --- Cryptography --- p.11 / Chapter 2.3 --- Digital Watermarking --- p.14 / Chapter 2.4 --- Essential Ingredients for Video Watermarking --- p.16 / Chapter 2.4.1 --- Fidelity --- p.16 / Chapter 2.4.2 --- Robustness --- p.17 / Chapter 2.4.3 --- Use of Keys --- p.19 / Chapter 2.4.4 --- Blind Detection --- p.20 / Chapter 2.4.5 --- Capacity and Speed --- p.20 / Chapter 2.4.6 --- Statistical Imperceptibility --- p.21 / Chapter 2.4.7 --- Low Error Probability --- p.21 / Chapter 2.4.8 --- Real-time Detector Complexity --- p.21 / Chapter 2.5 --- Review on Video Watermarking Techniques --- p.22 / Chapter 2.5.1 --- Video Watermarking --- p.25 / Chapter 2.5.2 --- Spatial Domain Watermarks --- p.26 / Chapter 2.5.3 --- Frequency Domain Watermarks --- p.30 / Chapter 2.5.4 --- Watermarks Based on MPEG Coding Struc- tures --- p.35 / Chapter 2.6 --- Comparison between Different Watermarking Schemes --- p.38 / Chapter 3 --- Novel Watermarking Schemes --- p.42 / Chapter 3.1 --- A Scene-based Video Watermarking Scheme --- p.42 / Chapter 3.1.1 --- Watermark Preprocess --- p.44 / Chapter 3.1.2 --- Video Preprocess --- p.46 / Chapter 3.1.3 --- Watermark Embedding --- p.48 / Chapter 3.1.4 --- Watermark Detection --- p.50 / Chapter 3.2 --- Theoretical Analysis --- p.52 / Chapter 3.2.1 --- Performance --- p.52 / Chapter 3.2.2 --- Capacity --- p.56 / Chapter 3.3 --- A Hybrid Watermarking Scheme --- p.60 / Chapter 3.3.1 --- Visual-audio Hybrid Watermarking --- p.61 / Chapter 3.3.2 --- Hybrid Approach with Different Water- marking Schemes --- p.69 / Chapter 3.4 --- A Genetic Algorithm-based Video Watermarking Scheme --- p.73 / Chapter 3.4.1 --- Watermarking Scheme --- p.75 / Chapter 3.4.2 --- Problem Modelling --- p.76 / Chapter 3.4.3 --- Chromosome Encoding --- p.79 / Chapter 3.4.4 --- Genetic Operators --- p.80 / Chapter 4 --- Experimental Results --- p.85 / Chapter 4.1 --- Test on Robustness --- p.85 / Chapter 4.1.1 --- Experiment with Frame Dropping --- p.87 / Chapter 4.1.2 --- Experiment with Frame Averaging and Sta- tistical Analysis --- p.89 / Chapter 4.1.3 --- Experiment with Lossy Compression --- p.90 / Chapter 4.1.4 --- Test of Robustness with StirMark 4.0 --- p.92 / Chapter 4.1.5 --- Overall Comparison --- p.98 / Chapter 4.2 --- Test on Fidelity --- p.100 / Chapter 4.2.1 --- Parameter(s) Setting --- p.101 / Chapter 4.2.2 --- Evaluate with PSNR --- p.101 / Chapter 4.2.3 --- Evaluate with MAD --- p.102 / Chapter 4.3 --- Other Features of the Scheme --- p.105 / Chapter 4.4 --- Conclusion --- p.106 / Chapter 5 --- Conclusion --- p.108 / Bibliography --- p.110

Bibliography: leaves 112-115