Master of Science / Department of Computer Science / Arslan Munir / Modern automobiles incorporate a network of electronic control units (ECUs) that provides a range of features such as safety, driver assistance, infotainment. Such network of ECUs in a vehicle are connected to each other through buses, forming interconnections called intra-vehicle network. Bus technologies that are widely used in modern day automobiles are controller area network (CAN), local interconnect network (LIN), and media oriented systems transport (MOST). These bus technologies, however, do not possess any security or dependability features, and thus are susceptible to vulnerabilities. Such vulnerabilities allow attackers to mount passive attacks (e.g., snooping) and/or active attacks (e.g., fault injection). In this study, we propose a scheme for secure authentication of automotive ECUs. Our proposed scheme ensures that only authenticated ECUs can participate in communication over the intra-vehicle network/bus. ECU authentication is carried out using certificate-based authentication which is implemented using elliptic curve cryptography (ECC). The study also proposes a symmetric (session) key-establishment mechanism within intra-vehicular network to establish a common symmetric (session) key for all ECUs to communicate over the network. The key-establishment mechanism removes the need of storing symmetric keys in ECU memory permanently. The study incorporates key refreshment by assigning a certain lifetime/timeframe period to symmetric (session) key and then regularly updates session key after the expiration of each lifetime. Our proposed method provides confidentiality and integrity in intra-vehicle ECU communication without violating safety and real-time constraints of the vehicle. Our approach leverages multi-core ECUs to provide fault-tolerance by using redundant multi-threading (FT-RMT), performs quick error detection (FT-QED) and accelerate performance using lightweight checkpointing (CP).

abstrakt

abstrakt

Abstract

none

A Thesis submitted to The University of Arizona College of Medicine - Phoenix in partial fulfillment of the requirements for the Degree of Doctor of Medicine. / Background: Dengue fever is the most common mosquito borne viral disease in the world. Its symptoms can be fairly nonspecific and most commonly include fever, rash, headache, and eye pain. Passive surveillance is currently the most prevalent method used to detect dengue cases in the United States. Identification of positive cases can be limited by the public’s awareness of the disease’s symptoms, barriers to healthcare seeking behavior, and by physician approval of laboratory testing. Objective: This study sought to evaluate barriers to dengue reporting, as well as the patient‐ level factors that may limit the efficacy of passive surveillance of dengue in Key West, Florida. Methods: Cross‐sectional surveys were administered across Key West, FL. Subjects were asked if they had a recent fever, additional dengue symptoms, and whether they sought medical care for these symptoms. Also the hypothetical question was posed: would you seek medical care for a fever greater than 102 F? Responses were stratified according to patient characteristics and demographics. Results: In Key West, patient‐level factors that influenced the decision to seek medical care for a high fever were: having a specific doctor call when sick (p<0.006), health insurance status (p<0.037), and ethnicity (p<0.005). Additionally, barriers to dengue reporting were identified. The most impactful were the decision to seek medical care for symptoms consistent with dengue fever, and the doctor’s decision to administer confirmatory dengue laboratory tests. Only one person with a recent fever plus one additional classic dengue symptom received laboratory testing, and this was done outside of the United States. There were four individuals who met the current WHO clinical case definition for dengue, yet none were offered laboratory testing or were diagnosed with the disease. Conclusion: This study shows that both patients and doctors in Key West, Florida underestimate the potential for dengue when there are symptoms consistent with the disease. As such, it is certainly possible that there have been unreported cases in the country.

The main goal of cryptography is to enable secure communication over a public channel; often a secret shared among the communicating parties is used to achieve this. The process by which these parties agree on such a shared secret is called key agreement. In this thesis, we focus on two-party key agreement protocols in the public-key setting and study the various methods used to establish and validate public keys. We pay particular attention to certificateless key agreement schemes and attempt to formalize a relevant notion of security. To that end, we give a possible extension of the existing extended Canetti-Krawzcyk security model applicable to the certificateless setting. We observe that none of the certificateless protocols we have seen in the literature are secure in this model; it is an open question whether such schemes exist. We analyze several published certificateless key agreement protocols, demonstrating the existence of key compromise impersonation attacks and even a man-in-the-middle attack in one case, contrary to the claims of the authors. We also briefly describe weaknesses exhibited by these protocols in the context of our suggested security model.

The main goal of cryptography is to enable secure communication over a public channel; often a secret shared among the communicating parties is used to achieve this. The process by which these parties agree on such a shared secret is called key agreement. In this thesis, we focus on two-party key agreement protocols in the public-key setting and study the various methods used to establish and validate public keys. We pay particular attention to certificateless key agreement schemes and attempt to formalize a relevant notion of security. To that end, we give a possible extension of the existing extended Canetti-Krawzcyk security model applicable to the certificateless setting. We observe that none of the certificateless protocols we have seen in the literature are secure in this model; it is an open question whether such schemes exist. We analyze several published certificateless key agreement protocols, demonstrating the existence of key compromise impersonation attacks and even a man-in-the-middle attack in one case, contrary to the claims of the authors. We also briefly describe weaknesses exhibited by these protocols in the context of our suggested security model.

Abstrakt

This work deals with the issue of multicast communication, specifically it focuses on group key management. It discusses group key management protocols as well as existing algorithms and algorithm designs for efficient key management and distribution. Based on the knowledge, two solutions were developed. The application for comparing the efficiency of algorithms was created as well. Both existing and proposed schemes were compared using two scenarios. Based on the resulting graphs, the suitability of individual algorithms was evaluated.