1,721,005 research outputs found
Reliable accounting in grids
No full textGrid computing is a distributed environment in which a remote service is provided by a resource owner to a client by means of a grid infrastructure. One of the major expectations for grid computing is about the rising of a market where users pay to access the computational and storage capacity offered by a resource owner. In this scenario, all the steps of the economic transaction related to the fulfilment of a service are accomplished with the mediation of the grid infrastructure. Several economic models have been proposed for determining how to charge the services offered through a grid. In this paper, we outline one important security issue that may arise in models where services are priced according to the amount of resources they consume. Our contribution is to propose a new security model where secure grid transactions are possible even when resource owners and clients are corrupted. Copyright © 2013 Inderscience Enterprises Ltd
Visualization of Cryptographic Protocols with GRACE
No full textIn this paper we present GRACE (graphical representation and animation for cryptography education), a Java-based educational tool that can be used to help in teaching and understanding of cryptographic protocols. The tool adopts an active learning model that engages the learner by asking him to describe, in an exemplification of a real-world scenario, cryptographic protocols using simple primitives whose effects are visualized by means of animated sequences. To this end, the GRACE interface offers the learner the choice of several cryptographic and non-cryptographic related operations with their respective visualizations. By executing a series of these operations in the proper order, a teacher is able to provide a visual introductory description of several protocols. Moreover, since some of the cryptographic operations are not just simulated but concretely implemented, it can be used by students to see which elaborations are performed by each operation of a cryptographic protocol, and their effects on the represented scenario. GRACE comes equipped with the implementation of several cryptographic primitives and cryptosystems. Additional primitives and cryptosystems can easily be plugged in the system. Visualizations prepared with GRACE can be edited, navigated and saved in a file for playback. We also present the results of an experimental lesson taught in the Security on Communication Networks undergraduate course at the University of Salerno during the fall 2004 semester using GRACE. A copy of GRACE and some demo lessons featuring the visualization of some cryptographic protocols are available at http://www.dia.unisa.it/research/grace
The design and implementation of a secure CAPTCHA against man-in-the-middle attacks
No full textIn this paper, we propose a novel security protocol for the implementation of CAPTCHA tests that feature advance mechanisms against man-in-the-middle (MITM, for short) attacks. This type of attack is fulfilled by a malicious entity, the MITM, that leverages on unaware users to mass-solve CAPTCHA tests shielding the access to a service. The protocol that we propose uses collision-resistant hash functions modeled as random oracles to guarantee that the solution to a CAPTCHA test solved by an end user is valid only for the server to which the user is connected to. This will prevent MITM attacks because the user is not directly connected to the server. We developed a reference implementation for our protocol that has a low impact and is easy to use, featuring a software plug-in running in the Firefox web browser, on the client side, and a Java servlet-based application, on the server side. © 2013 John Wiley & Sons, Ltd
A review of security attacks on the GSM standard
No full textThe Global Systems for Mobile communications (GSM) is the most widespread mobile communication technology existing nowadays. Despite being a mature technology, its introduction dates back to the late eighties, it suffers from several security vulnerabilities, which have been targeted by many attacks aimed to break the underlying communication protocol. Most of these attacks focuses on the A5/1 algorithm used to protect over-the-air communication between the two parties of a phone call. This algorithm has been superseded by new and more secure algorithms. However, it is still in use in the GSM networks as a fallback option, thus still putting at risk the security of the GSM based conversations. The objective of this work is to review some of the most relevant results in this field and discuss their practical feasibility. To this end, we consider not only the contributions coming from the canonical scientific literature but also those that have been proposed in a more informal context, such as during hacker conferences. © 2013 Springer-Verlag
JSEB (Java Scalable sErvices Builder): Scalable Systems for Clusters of Workstations
No full textWe present a report on JSEB (Java Scalable Service Builder) whose goal is to offer programmers a tool that can be used to efficiently add scalability and fault-tolerance to a replicated service in cluster(s) of workstation
Progetto di algoritmi e strutture dati in Java
No full textIl testo, concepito soprattutto per i corsi universitari delle facoltà di Ingegneria e di Scienze, offre un'introduzione allo studio di algoritmi e di strutture dati orientato alla realizzazione di programmi efficienti in Java e affronta con rigore metodologico aspetti di progettazione e di ingegnerizzazione del codice. Particolare enfasi viene data anche al trasferimento in applicazioni reali delle metodologie algoritmiche illustrate. Il materiale didattico è infatti accompagnato, passo dopo passo, da un progetto software che prevede la realizzazione di un motore di ricerca semplificato. Il progetto software viene presentato, discusso e articolato nei vari capitoli del testo, ognuno dei quali ne prevede la realizzazione di una parte come applicazione conclusiva delle tecniche algoritmiche studiate nel capitolo
Experimentations with source camera identification and Online Social Networks
No full textIn this paper is presented an extended experimental evaluation of one of the most effective source camera identification techniques proposed so far, by Lukáš et al. (IEEE Trans Inf Forensics Security 1(2):205-214, 2006). This method uses the characteristic noise left by the sensor on a digital picture as a fingerprint in order to identify the source camera used to take the picture. The aim of the experiments is to assess the effectiveness of this technique when used with pictures that were previously modified using several common image-processing functions coming with photo-editing tools. Moreover, the technique is applied to photos passed through Online Social Networks or Online Photo Sharing websites, without any "human" explicit modification but only elaborated by such Web 2. 0 tools. The results confirm that, in several cases, the method by Lukáš et al. (IEEE Trans Inf Forensics Security 1(2):205-214, 2006) is resilient to the modifications introduced by the considered image-processing functions. However, in the experiments it has been possible to identify several cases where the quality of the identification process deteriorated because of the noise introduced by the image-processing. In addition, when dealing with Online Social Networks and Online Photo Sharing services, it has been noted that some of them process and modify the uploaded pictures. These modifications make ineffective, in many cases, the method by Lukáš et al. (IEEE Trans Inf Forensics Security 1(2):205-214, 2006) © 2011 Springer-Verlag
A Lightweight Security Model for WBEM
No full textWeb-Based Enterprise Management (WBEM) is an emerging standard solution for remote management of heterogeneous devices. It allows to remotely operate and administer a group of hardware and software devices while preserving some security features. The aim of this paper is two-fold: 1) We raise concerns regarding security weaknesses of the architecture of WBEM. 2) We propose a lightweight security model for WBEM based on the concept of Attribute Authority and show its effectiveness in preserving both the security and the performance of the system. Moreover, we address the concept of accountability and present guidelines for an implementation of our model
- …
