With more applications accessible on the Web, organizations with mission-critical legacy systems have had to find a way to stay relevant and competitive by modernizing with RESTful APIs. REST architecture, serving as a guideline rather than a strict protocol, offers significant advantages in terms of scalability, flexibility, and independence; however, its widespread adoption has also led to notable security vulnerabilities and weaknesses. Additionally, there is not one all-encompassing security testing methodology to follow when testing RESTful APIs. For this reason, a new security testing methodology was developed for legacy MultiValue Pick systems that implement the REST API component, MVConnect. The steps of the methodology consist of: threat modeling, source code review, penetration testing, and mitigation. A case study involving a legacy D3 MultiValue Pick Database Management System (DMS) implementing MVConnect was assessed following this methodology. Several vulnerabilities were identified, discovered, and exploited including the following: security misconfigurations, broken authentication, broken authorization, session mismanagement, server-side request forgery, and unsafe consumption of APIs. Mitigation solutions were proposed including basic authentication and authorization control mechanisms specific to D3 MultiValue Pick and proper firewall rules to administer. The new security testing methodology enabled a successful security assessment of a legacy MultiValue Pick system that employed MVConnect. The mitigation solutions are capable of securing legacy MultiValue Pick systems implementing MVConnect.

Made available in DSpace on 2016-04-04T18:31:42Z (GMT). No. of bitstreams: 1 DANIEL ADORNO GOMES-2.pdf: 6264883 bytes, checksum: cca792dc8793e5981e4202615260916c (MD5) Previous issue date: 2015-06-26 / This paper presents a proposal for architecture for interconnection of wireless sensor networks and the Internet using only the application layer, without the need to change the protocol stack of both networks. The architecture is based on the HTTP protocol, proposing the use of web services technology to interconnect the two network standards. From the installation of a wireless sensor network in a closed environment, its interconnection was performed with the Internet based on the proposed architecture using open standard technologies, the protocol for REST web services and cloud computing structure of the company Amazon Web Services. Information was collected to evaluate the functionality, reliability and system efficiency, accordingly to the ABNT standard, ISO / IEC 9126. The results showed the feasibility of implementing this proposal because it was shown that the interconnection is possible between these network standards using the application layer, reliably, efficiently and with the use of low cost resources. This study might encourage proposals to extend the accessibility of sensor networks to mobile devices. / Este trabalho apresenta uma proposta de arquitetura para interconex?o de redes de sensores sem fio e a Internet utilizando somente a camada de aplica??o, sem que haja a necessidade de altera??o da pilha de protocolos de ambas as redes. A arquitetura baseia-se no protocolo HTTP, propondo a utiliza??o da tecnologia de web services para interconectar os dois padr?es de rede. A partir da instala??o de uma rede de sensores sem fio num ambiente fechado, foi realizada a sua interconex?o com a Internet com base na arquitetura proposta, utilizando tecnologias de padr?o aberto, o protocolo para web services REST e uma estrutura de computa??o em nuvem da empresa Amazon Web Services. Foram coletadas informa??es para que se pudesse avaliar a funcionalidade, a confiabilidade e a efici?ncia do sistema, de acordo com a norma da ABNT, NBR ISO/IEC 9126. Os resultados apontaram para a viabilidade de implementa??o dessa proposta, pois, demonstrou-se que ? poss?vel a interconex?o entre esses padr?es de rede utilizando a camada de aplica??o, de forma confi?vel, eficiente e com a utiliza??o de recursos de baixo custo. Este estudo pode embasar propostas para estender a acessibilidade das redes de sensores aos dispositivos m?veis.

Sistemas computacionais são constituídos por componentes de hardware e software que podem eventualmente falhar. Por esse motivo, o mecanismo de transação sempre foi imprescindível para a construção de sistemas robustos. O suporte transacional para a tecnologia Web services foi definido em agosto de 2005, num conjunto de três especificações denominadas WS-Coordination, WS-AtomicTransaction e WS-BusinessActivity. Juntas, essas especificações definem um alicerce sobre o qual aplicações robustas baseadas em Web services podem ser construídas. Nesta dissertação realizamos um estudo sobre transações atômicas em ambientes Web services. Em particular, estendemos o gerenciador de transações presente no servidor de aplicações JBoss, de modo que ele passasse a comportar transações distribuídas envolvendo Web services. Além disso, avaliamos o desempenho desse gerenciador de transações quando ele emprega cada um dos seguintes mecanismos de chamada remota: Web services/SOAP, CORBA/IIOP e JBoss Remoting. Finalmente, realizamos experimentos de escalabilidade e interoperabilidade. / Computing systems consist of a multitude of hardware and software components that may fail. For this reason, the transaction mechanism has always been essential for the development of robust systems. Transactional support for the Web services technology was defined in August 2005, in a set of three specifications, namely WS-Coordination, WS-AtomicTransaction, and WS-BusinessActivity. Together, such specifications enable the development of robust Web services applications. In this dissertation we studied atomic transactions in the Web services realm. Particularly, we added Web services atomic transaction support to the existing JBoss application server transaction manager. Furthermore, we evaluated the performance of this transaction manager when it employs each of the following remote method invocation mechanisms: Web services/SOAP, CORBA/IIOP and JBoss Remoting. Finally, we performed scalability and interoperability experiments.

Dans cette thèse nous abordons la gestion des risques appliquée aux systèmes d’information distribués. Nous traitons des problèmes d’interopérabilité et de sécurisation des échanges dans les systèmes DRM et nous proposons la mise en place de ce système pour l’entreprise: il doit nous permettre de distribuer des contenus auto-protégés. Ensuite nous présentons la participation à la création d’une entreprise innovante qui met en avant la sécurité de l’information, avec en particulier la gestion des risques au travers de la norme ISO/IEC 27005:2011. Nous présentons les risques liés à l’utilisation de services avec un accent tout particulier sur les risques autres que les risques technologiques; nous abordons les risques inhérents au cloud (défaillance d’un provider, etc...) mais également les aspects plus sournois d’espionnage et d’intrusion dans les données personnelles (Affaire PRISM en juin 2013). Dans la dernière partie nous présentons un concept de DRM d’Entreprise qui utilise les métadonnées pour déployer des contextes dans les modèles de contrôle d’usage. Nous proposons une ébauche de formalisation des métadonnées nécessaires à la mise en œuvre de la politique de sécurité et nous garantissons le respect de la réglementation et de la loi en vigueur. / In this thesis we discuss the application of risk management to distributed information systems. We handle problems of interoperability and securisation of the exchanges within DRM systems and we propose the implementation of this system for the company: it needs to permit the distribution of self-protected contents. We then present the (our) participation in the creation of an innovative company which emphasizes on the security of information, in particular the management of risks through the ISO/IEC 27005:2011 standard. We present risks related to the use of services, highlighting in particular the ones which are not technological: we approach inheritent risks in clouds (provider failure, etc ...) but also the more insidious aspects of espionage and intrusion in personal data (Case PRISM in June 2013). In the last section, we present a concept of a DRM company which uses metadata to deploy settings in usage control models. We propose a draft formalization of metadata necessary for the implementation of a security policy and guarantee respect of regulations and legislation.

En esta tesis se ha desarrollado un marco de trabajo que hace uso de las tecnologías de agentes y de Servicios Web Semánticos para la elaboración de aplicaciones que puedan tratar con el dinamismo de la Web, al tiempo que se pueden beneficiar de características como la autonomía, el aprendizaje y el razonamiento. Éste es el punto en que cobra relevancia la Ingeniería Ontológica. Las ontologías son los componentes que permiten que la comunicación entre agentes y Servicios Web, situados a distintos niveles de abstracción, se produzca de forma fluida y sin interpretaciones erróneas. La arquitectura del marco de trabajo desarrollado consta, fundamentalmente, de un entorno multi-agente, un conjunto de bases de conocimiento y diversas interfaces que permiten al sistema comunicarse, de forma efectiva, con las entidades externas identificadas, a saber, Servicios Web y proveedores de servicios, entidades (usuarios) consumidores de servicios, y desarrolladores. / In this thesis, a knowledge-based Semantic Web Services framework that successfully integrates Intelligent Agents and Semantic Web Services technologies has been developed. For achieving this combination, the framework takes an ontology-centred approach. Ontologies are the facilitating technology that enables a seamlessly communication between agents and services.

Die Konzepte zur Erstellung von Software-Produktlinien dienen der ingenieurmäßigen, unternehmensinternen Wiederverwendung existierender Software-Artefakte. Existierende Ansätze nutzen von Hand erstellte und gewartete Kompositionsprogramme zum Assemblieren der Produkte entsprechend einer Variantenauswahl. Der Einsatz einer automatischen Planungskomponente sowie eines einfachen, erweiterbaren Komponenten-Meta-Modells hilft dabei, die dabei anfallenden Daten computergestützt zu verarbeiten. Die Integration beider Konzepte zu einem hybriden Ansatz ermöglicht die Neuerstellung von Produkten, die nicht von Anfang an als Produktlinie konzipiert sind, ohne eine spätere Umarbeitung unter Nutzung der automatischen Planungskomponente unnötig zu erschweren.

Das Ziel der Diplomarbeit bestand darin eine Testumgebung zur Orchestrierung von Geo Web Services aufzubauen. Dabei diente die Diplomarbeit "Orchestrierung von Web Services" von Jäger/Weidenhagen als Grundlage. Um ein Verständnis für dieses Gebiet zu bekommen, werden zu Beginn die Grundlagen betrachtet. Rechtliche Aspekte zum Thema Orchestrierung werden angegeben, um die Wichtigkeit des Themas zu unterstreichen. Eingängige Standards wie SOAP und WSDL werden in ihren Kernpunkten erläutert. Insbesondere bei SOAP wird näher darauf eingegangen. Neben den OWS besteht auch die Möglichkeit Geo-Datenbanken in Diensteketten einfließen zu lassen. Dafür werden exemplarisch Dienste aufgesetzt, die dies ermöglichen. Weiterhin werden die Benutzerschnittstellen von Web Services (und auch Diensteketten) untersucht. Die Option eines Clients mittels Scriptsprachen wird beschrieben. Dabei erwies sich PHP am geeignetsten. Auf diese Weise kann für jede Dienstekette eine dynamische Webseite gestaltet werden, die eine graphische Schnittstelle für den Nutzer bietet.

Le domaine de la logistique implique souvent la résolution de problèmes combinatoires complexes. Ces derniers font également implicitement référence à des processus, acteurs, activités et méthodes concernant divers aspects qu'il faut considérer. Ainsi, un même problème peut faire intervenir des processus de vente/achat, transport/livraison et gestion de stock. Ces processus sont tellement divers et interconnectés qu'il est difficile pour un logisticien de tous les maîtriser. Dans cette thèse, nous proposons l'explicitation, par le biais d'ontologies, de connaissances conceptuelles et sémantiques concernant les processus logistiques. Ces connaissances explicites sont alors mises à contribution pour construire un système à base de connaissances permettant de guider les logisticiens dans la construction, de façon incrémentale et semi-automatique, de solutions informatiques à un problème qui leur est posé à un moment donné. Nous mettons en oeuvre une ontologie concernant le domaine de la logistique connectée à une ontologie associée à la problématique de l'optimisation. Nous établissons ainsi un lien sémantique explicite entre le domaine de la logistique et celui de l'optimisation. Cela permet aux logisticiens d'identifier de façon précise et sans ambigüité le problème logistique auquel il est confronté et les problèmes d'optimisation associés. L'identification des problèmes conduit alors à un processus de choix des solutions allant du choix du processus logistique précis à mettre en oeuvre à celui de la méthode de résolution du problème combinatoire et cela jusqu'à la découverte du composant informatique à invoquer et qui est matérialisé par un service web. L'approche que nous avons adoptée et mise en oeuvre a été expérimentée avec les problèmes de routage de véhicules, le problème de transport ferroviaire de passagers et le problème de terminaux de conteneurs. / Logistics problems are often complex combinatorial problems. These may also implicitly refer to the processes, actors, activities, and methods concerning various aspects that need to be considered. Thus the same process may involve the processes of sale/purchase, transport/delivery, and stock management. These processes are so diverse and interconnected that it is difficult for a logistic expert to compete all of them. In this thesis, we propose the explications with the help of ontologies of conceptual ans semantic knowledge concerning the logistic processes. This explicit knowledge is then used to develop a reasoning system to guide the logistic expert for an incremental and semi-automatic construction of a software solution to an instantly posed problem. We define an ontology concerning the inter-connected logistics and associated optimization problem. We, henceforth, establish an explicit semantic link between the domains of logistics and the optimization. It may allow the logistic expert to identify precisely and unambiguously the confronted logistic problem and the associated optimization problem. The identification of the problems then leads to a process to choose the solutions ranging from the choice of the precise logistic process to be implemented to that of the method to solve the combinatorial problem until the discovery of the software component to be invoked and which is implemented by a web service. The approach we have adopted and implemented has been experimented with the "Vehicle Routing Problems", the "Passenger Train Problem" and the "Container Terminal problems".

Made available in DSpace on 2016-06-02T19:05:42Z (GMT). No. of bitstreams: 1 2927.pdf: 7308846 bytes, checksum: 00bf87c13681e4b1b09267e924ecd6a8 (MD5) Previous issue date: 2010-02-19 / The use of Information Systems in health environments, like the substitution of paper versions of medical records by electronics ones, has improved patient assistance and allowed such information to be available in a more accessible way. Along with this technology, however, there are significant issues raised by the patients about the access control over their confidential data, which becomes more available and could be accessed by unauthorized people. It is in this scenario that Health - Privilege Management Infrastructure, or H-PMI, is presented in this work. It aims to provide a software architecture for privilege management in health environments. H-PMI aims to be adherent to the Brazilian laws and rules related to the access to electronic medical records, like the ones defined in Manual de Certificação de Sistemas da Área de Saúde by Conselho Federal de Medicina and Sociedade Brasileira de Informática em Saúde. The main objective of this work is to specify the envisioned H-PMI, so it can provide restricted access to electronic medical records in accordance with the appropriate law and recommendations security guarantees, allowing trusted access to sensitive data while allowing circumstantial access to these data in exceptional situations. In order to evaluate the applicability of the proposed H-PMI architecture we have developed the Web H-PMI, which is integrated with the Google Health platform. The obtained results show that the developed architecture can be applied in existing health environments. / A informatização dos ambientes da área de saúde, como a substituição dos prontuários em papéis por versões eletrônicas, permitiu diversas melhorias no atendimento aos pacientes, além da disponibilização de informações de forma mais acessível. Porém, com esta tecnologia surgiram preocupações maiores por parte dos pacientes em relação ao controle de acesso aos seus dados confidenciais, uma vez que com a acessibilidade facilitada, a possibilidade de pessoas não autorizadas acessarem tais dados também é ampliada. É neste cenário que está incluído o Health - Privilege Management Infraestructure, ou HPMI, tratado neste trabalho, que visa a apresentar uma Arquitetura para o Gerenciamento de Privilégios para Sistemas de Informação da área de saúde. H-PMI almeja ser aderente às normas e leis brasileiras, sendo fiel às regras de certificação de sistemas da área de saúde definidas pelo Conselho Federal e Medicina em conjunto com a sociedade Brasileira de Informática em Saúde. O objetivo deste trabalho é especificar o H-PMI, de forma que ele seja capaz de fornecer garantias de seguranças necessárias segundo a legislação vigente, permitindo um acesso legítimo a dados confidenciais, além de conceder o acesso a dados restritos em situações excepcionais em que isto é autorizado. Como resultado do desenvolvimento do trabalho proposto, implantou-se o Web H-PMI integrado com o Google Health demonstrando a capacidade de implantação de parte substancial da arquitetura proposta em ambientes existentes.

Submitted by Fernando Souza (fernandoafsou@gmail.com) on 2017-08-17T12:28:32Z No. of bitstreams: 1 arquivototal.pdf: 3788055 bytes, checksum: 45e407b9d1250559dd18ae265ae1410b (MD5) / Made available in DSpace on 2017-08-17T12:28:32Z (GMT). No. of bitstreams: 1 arquivototal.pdf: 3788055 bytes, checksum: 45e407b9d1250559dd18ae265ae1410b (MD5) Previous issue date: 2014-02-12 / The emergence of Digital TV brought, beyond high definition, the potential of the interactivity and metadata relative to the TV programmes, but some information provided by the broadcasts can be insufficient to the user make a decision on what he/she is going to watch. This work aims to propose a Semantic Query approach in the Interactive Digital TV environment, based on the concepts and designs of the Semantic Web, providing an advanced service of semantic query, and a way for doing metadata enrichment coming from the broadcasters, adding semantic relationships and expanding the information in a graph of data coming from the Linked Data cloud. A Web Service of Semantic Query integrated into the Knowledge-TV platform was developed to validate this proposal. / O surgimento da TV Digital trouxe, além da alta definição, o potencial da interatividade e metadados relativos à programação da TV. Porém, algumas informações disponibilizadas pelas emissoras podem não ser suficientes para o usuário tomar uma decisão sobre o que vai assistir. Esse trabalho tem como objetivo propor uma abordagem de Consultas Semânticas no ambiente da TV Digital Interativa baseada nos conceitos e padrões da Web Semântica, especificando uma arquitetura de Serviço Web com o objetivo de prôver um meio de enriquecimento dos metadados vindos da emissora, expandindo as informações e adicionando relacionamentos semânticos em um grafo de dados provenientes da nuvem Linked Data. Um Serviço Web de Consulta Semântica integrado à plataforma Knowledge-TV foi desenvolvido para validar essa abordagem.