Servicio de seguridad combinable mediante técnicas de orquestación de servicios

En los últimos años, la seguridad en redes y servicios ha evolucionado de manera exponencial debido al crecimiento de dispositivos conectados a Internet. Con el avance de las nuevas tecnologías es imprescindible dotar a cualquier servicio o dispositivo de la seguridad adecuada dado que éstos se pueden ver afectados por diversas amenazas tales como la accesibilidad, la integridad, la identidad del usuario, la disponibilidad y la confidencialidad de los datos. Cuando se trata de comunicaciones, la seguridad cobra especial importancia dado que los datos enviados a través de la red pueden ser interceptados por un agente no autorizado y utilizarlos para su propio beneficio o alterar su contenido. Para contrarrestar estos ataques, se han definido unos servicios de seguridad como son, por ejemplo, la confidencialidad y la integridad de los datos. Existen diversos mecanismos de seguridad que implementan estos servicios los cuales se apoyan en técnicas criptográficas. Desde el comienzo de las primeras comunicaciones se han desarrollado diferentes técnicas criptográficas que han ido evolucionando a la vez que éstas. La primera de estas técnicas conocida fue escítala lacedemonia en el siglo V a.C. Los éforos espartanos, que eran los que utilizaban dicha técnica, escribían el mensaje en una cinta de cuero o papiro enrollada en una vara de grosor variable. A continuación desenrollaban la cinta y la enviaban al receptor. Sí el mensaje era interceptado solo podrían leer una pila de letras sin sentido. Sí el mensaje llegaba al receptor, éste enrollaría de nuevo la cinta en una vara del mismo grosor que lo hizo el emisor y leería el mensaje. En este proyecto de fin de grado se va a realizar un estudio del estado de arte sobre mecanismos de seguridad para posteriormente diseñar e implementar un componente de seguridad que ofrecerá los servicios citados. Dicho componente se integrará en el sistema del proyecto Europeo I3RES como un servicio más de los definidos dentro del propio proyecto. Los servicios de seguridad que requiere el proyecto I3RES, y por tanto los que ofrecerá el componente, son los de autenticación, integridad, no repudio y confidencialidad. El proyecto I3RES basa su sistema en una arquitectura distribuida por lo que es necesario realizar un estudio del estado del arte sobre dichas arquitecturas para el correcto despliegue del componente en el sistema. Actualmente, la mayoría de los sistemas mantienen una arquitectura distribuida. Este tipo de arquitectura conecta distintos equipos y dispositivos que están separados físicamente mediante una red llamada middleware. Estos equipos trabajan conjuntamente para implementar un conjunto de servicios. En el documento presente se tratan todos los temas anteriormente citados y se detalla el componente a desarrollar así como las correspondientes pruebas de validación y las conclusiones obtenidas. ABSTRACT. Security in networks and services have been extensively developed in last decades due to the arising of multiple devices connected to Internet. Advances in new technologies enhanced the necessity of security requirements to in order to avoid several warnings such as accessibility, integrity, user identity, availability, and confidentiality of our data. In terms of communications, security is crucial due to data could be intercepted on Internet by non-authorised agents which could use them or even alter their content. In order to avoid this warnings, security services have been defined such as data confidentiality and integrity. There is several security mechanism which implement this services based on cryptographic techniques. In parallel to the evolution of communication, cryptographic technics have been also developed with. The most ancient of technics was described in s. V b.C called escitala lacedemonia. Spartan ephorts, which extensively used this method, were used to write messages on the surface of a leather tape or papyri which were rolled on a rod. Next, they unrolled the tape and they sent to the receptor. Whether the message was intercepted they just would be able to read a mess of letters without sense. On the other hand, if the message arrive to the proper receptor, he roll the tape again in a rod with similar anchor of the transmitter one which leads to the adequate read. This Degree Project is focused on an analysis of the state of art about security mechanism together with a design and implement of a security component which offered the services mentioned. This component will be integrated within the European project I3RES as one of the security elements defined inside the project. The security components required in project I3REs are authentication, integrity and non-repudiation will be offered by the designed component as well. Nowadays, the most of the systems maintain a distributed architecture. This type of architecture connect several devices which are physically separated by a network called middleware. This equipment work altogether to implement a set of services. This document is focused on all the topics mentioned as well as the details of the component developed together with the validation tests required and the conclusions obtained.

University employees work schedule

The aim of this project is to create a website which is useful both employees and students of a university, so employees can add information, if they log in with username and password access, and students can view this information . Employees may modify and display information such as title, room, or their faculty (from a list defined by the administrator), and most importantly, their schedule, whether class, tutoring, free time, or any of tasks that the administrator define. There will be a manager, responsible for managing employees, the availables faculties and the types of tasks that employees can use on their schedule. Students may see the employees schedules and rooms on the homepage. They differentiate between differents tasks of employees, because these are in different colors. They can also filter information for faculty, employee or day. To achieve our goal, we decided to program in Java using Servlets, which we will use to generate response to requests coming from users from the website. We will also use JSP, allowing us to create different websites files. We use JSP files and not HTML, because we need that the pages are dynamic, since not only want to show specific information, we like that information can change depending on user requests. The JSP file allows us to generate HTML, but also using JAVA language, which is necessary for our purpose. As the information we store is not fixed. We want this information can be modified at any time by employees and admin, so we need a database, which can be accessed from anywhere. We decided SQLite databases because are integrated quite well in our application, and offer a quick response. To access the database from our program, we simply connect it to the database, and with very few lines of code, add, delete or modify entries in different tables that owns the database. To facilitate the initial creation of the database, and the first tables, we use a Mozilla Firefox browser plugin, called SQLite Manager, which allows us to do so from a more friendly interface. Finally, we need a server that supports and implements specifications Servlets and JSP. We decided on the TomCat server, which is a container Servlets, because is free, easy to use, and compatible with our program. We realized all the project with Eclipse environment, also free program that allows integrating database, server and program the JSP and Servlets. Once submitted all the tools we used, we must first organize the structure of the web, relating each Servlets with JSP files. Next, create the database and the different Servlets, and adjust the database accesses to make sure we do it right. From here simply is to build up the page step by step, showing in each place we need, and redirect to different pages. In this way, we can build a complex website, free, and without being an expert in the field. RESUMEN. El objetivo de este proyecto, es crear una página web que sirva tanto a empleados como a alumnos de una universidad, de tal manera que los empleados podrán añadir información, mediante el acceso con usuario y contraseña, y los alumnos podrán visualizar está información. Los empleados podrán modificar y mostrar información como su título, despacho, facultad a la que pertenecen (de entre una lista definida por el administrador), y lo más importante, sus horarios, ya sean de clase, tutorías, tiempo libre, o cualquiera de las tareas que el administrador defina. Habrá un administrador, encargado de gestionar los empleados existentes, las facultades disponibles y los tipos de tareas que podrán usar los empleados en su horario. Los alumnos, podrán visualizar los horarios y despacho de los empleados en la página principal. Diferenciarán entre las distintas tareas de los profesores, porque estas se encuentran en colores diferentes. Además, podrán filtrar la información, por facultad, empleado o día de la semana. Para conseguir nuestro objetivo, hemos decidido programar en Java, mediante el uso de Servlets, los cuales usaremos para generar respuesta antes las peticiones que llegan de los usuarios desde la página web. También usaremos archivos JSP, que nos permitirán crear las diferentes páginas webs. Usamos archivos JSP y no HTML, porque necesitamos que las diferentes páginas sean dinámicas, ya que no solo queremos mostrar una información concreta, si no que esta información puede variar en función de las peticiones de usuario. El archivo JSP nos permite generar HTML, pero a la vez usar lenguaje JAVA, algo necesario para nuestro cometido. Como la información que queremos almacenar no es fija, si no que en todo momento debe poder ser modificada por empleados y administrador, necesitamos una base de datos, a la que podamos acceder desde la web. Nos hemos decidido por bases SQLite, ya que se integran bastante bien en nuestra aplicación, y además ofrecen una rápida respuesta. Para acceder a la base de datos desde nuestro programa, simplemente debemos conectar el mismo a la base de datos, y con muy pocas líneas de código, añadir, eliminar o modificar entradas de las diferentes tablas que posee la base de datos. Para facilitar la creación inicial de la base de datos, y de las primeras tablas, usamos un complemento del navegador Mozilla Firefox, llamado SQLite Manager, que nos permite hacerlo desde una interfaz más amigable. Por último, necesitamos de un servidor que soporte e implemente las especificaciones de los Servlets y JSP. Nos decidimos por el servidor TomCat, que es un contenedor de Servlets gratuito, de fácil manejo, y compatible con nuestro programa. Todo el desarrollo del proyecto, lo realizamos desde el entorno Eclipse, programa también gratuito, que permite integrar la base de datos, el servidor y programar los JSP y Servlets. Una vez presentadas todas las herramientas que hemos utilizado, primero debemos organizar la estructura de la web, relacionando cada archivo JSP con los Servlets a los que debe acceder. A continuación creamos la base de datos y los diferentes Servlets, y ajustamos bien los accesos a la base de datos para comprobar que lo hacemos correctamente. A partir de aquí, simplemente es ir construyendo la página paso a paso, mostrando en cada lugar lo que necesitemos, y redirigiendo a las diferentes páginas. De esta manera, podremos construir una página web compleja, de manera gratuita, y sin ser un experto en la materia.

Framework para el desarrollo con el DNIe

El proyecto se trata de una API de desarrollo para el DNI electrónico que permita crear de forma sencilla aplicaciones cuya funcionalidad se apoye en el uso del DNI electrónico. De esta forma, el framework facilita el acceso a las principales operaciones soportadas por el DNIe mediante la invocación de métodos sencillos. Una de las funcionalidades es la de realizar un proceso de autenticación con el DNIe utilizando para ello las capacidades criptográficas del chip que incorpora y el certificado de autenticación. Esta funcionalidad puede ser accedida también de forma dividida en dos pasos, para dar soporte a aplicaciones con arquitectura cliente-servidor. El framework también ofrece la funcionalidad de firma electrónica con el DNIe, una firma legalmente válida y que permite chequear también la integridad del mensaje firmado. También se soporta por el framework la comprobación de un certificado mediante el protocolo OCSP, funcionalidad que si bien no implica directamente al DNIe, sí que es importante en el marco de procesos que se ven involucrados en cualquier Infraestructura de Clave Pública. ABSTRACT The project is a development API for DNIe card that allows easily create applications whose functionality is supported in the use of DNIe. Thus, the framework provides access to the main operations supported by the DNIe by invoking simple methods. One of the features is to perform an authentication process with the DNIe using its chip’s capabilities and authentication certificate. This functionality can also be accessed so divided into two steps, to support applications with client-server architecture. The framework also provides the functionality of electronic signatures with DNIe, a legally valid signature and allows also check the integrity of the signed message. Verification of a certificate using OCSP, functionality but does not imply directly to DNIe is also supported by the framework, yes it is important in the context of processes that are involved in any Public Key Infrastructure.

Análisis de la incidencia lesional en el fútbol profesional español en la temporada 2008-2009

Se ha descrito en la literatura como el fútbol es un deporte en cuya práctica existe una alta incidencia de lesión. Sin embargo, en España, hasta el momento no se había llevado a cabo ningún estudio que analizara la incidencia de lesión de los jugadores de fútbol profesional. Para poder prevenir lesiones, en primer lugar debemos de identificar la magnitud del problema, así como conocer aquellos factores que pueden influir sobre la producción de lesiones, Éste es principal objetivo de nuestro estudio para, a partir de él, poder diseñar e introducir en la práctica deportiva medidas preventivas con el objetivo de disminuir la incidencia de lesión en el fútbol. Hay que considerar que nos encontramos ante un estudio descriptivo, el cual se caracteriza, por no tener una hipótesis previa. En él nos planteamos como principal objetivo el conocer la influencia de los diferentes factores que influyen en la posibilidad de sufrir una lesión en el fútbol, además de realizar un análisis que describiera las lesiones sufridas, así como sus periodos de recuperación, en el fútbol profesional español, En esta investigación, participaron 27 equipos pertenecientes a la primera y segunda división española (728 jugadores), registrándose durante la temporada 2008- 2009 un total de 2184 lesiones. Para el registro de las lesiones, se utilizó el cuestionario REINLE cumplimentado de forma confidencial por miembros del equipo técnico de los clubes colaboradores, a través de la base de datos LEFUTPRO con acceso vía internet. Como dato general, encontramos que en la práctica del fútbol profesional existe una elevada incidencia de lesión con 8,92 les.*1000h. de exposición, siendo ésta mayor en competición (41,33 les.*1000h.) que en entrenamiento (6,02 les.*1000h.), valores muy acordes a los encontrados en la literatura científica especifica. Se registraron un promedio de 81 lesiones que causaron baja por equipo y temporada, provocando una ausencia media por lesión de 11,3 días. De estas lesiones, el 11,9% de ellas fueron de carácter recidivante, las cuales causaron periodos de baja superiores a las lesiones iníciales, alcanzando un valor promedio de 17,9 días de baja por lesión. El 84,4% las lesiones que se registraron, se localizaron en la extremidad inferior, siendo el muslo, con un 30,5% de todas las lesiones, la región corporal más afectada. A su vez, dentro del muslo, el 53% de las lesiones se localizaron en la región posterior, dentro de la cual, en el 73% de los casos la lesión afectó al bíceps femoral. Además, se encontró una mayor frecuencia de lesión en la pierna dominante (54,4% de las todas las lesiones) frente a la no dominante (36,5% de las todas las lesiones). Desde el punto de vista de la tipología de la lesión, las lesiones de carácter muscular con un 49,1% de los casos, fueron las más frecuentes, seguidas de las lesiones ligamentosas con un 15,1% de los casos. Los mecanismos de producción de lesiones en el jugador sin contacto, fueron más frecuentes (69,1% de todos los casos), que aquellos mecanismos de lesión en los que si hubo contacto (30,9%). En relación al momento de producción de lesión a lo largo de la temporada, se encontró que las lesiones sufridas en entrenamiento fueron progresivamente menos frecuentes con el transcurso de la temporada, mientras que en la competición se fueron incrementando, siendo los últimos meses de la temporada cuando se registraron la mayor parte de las lesiones. A partir de este estudio, proponemos ampliar la investigación en esta línea, concretando algunos de los aspectos que hemos podido identificar a través de nuestros resultados, y que en un futuro puedan tener alguna aplicación práctica en el objetivo común de reducir la incidencia de lesión existente en la práctica deportiva del fútbol. ABSTRACT Football has been described in literature as a sport in which there is a high incidence of injuries. Nevertheless, in Spain, to date, not a single study analyzing the incidence of lesions in professional football players has been carried out. In order to prevent lesions, in the first place we must identify the magnitude of the problem, as well as discover those factors that may influence on the production of lesions, being the latter the main objective of our study, and hence, starting from this point, be able to design and introduce in sports practice preventive measures with the aim of decreasing the incidence of lesions. We must take into consideration that we are before a study characterized by the fact of not having a previous hypothesis. In the present study, our main areas of focus is finding out the different factors that have influence on the possibility of suffering a lesion in this sports practice, as well as carrying out an analysis that describes the lesions suffered in professional football, as well as the necessary recovery periods. 27 teams (728 players), belonging to Spain’s First and Second Football (soccer) Divisions took part in this research. During the 2008-2009 season, a total of 2,184 lesions were registered. To register the lesions, a REINLE questionnaire, of the LEFUTPRO database was used, with access via internet. Each of the participating teams was given a password in a totally confidential manner. In the first place, we found that in the practice of professional football there exists a high incidence of lesions, with 8.92 lesions per 1000 h. of exposure. We found an increase in lesions during competitions (41.33 lesions per 1000 h.) with respect to those occurring during training (6.02 lesions per 1000 h.); these values being in accordance with those found in specific scientific literature. An average of 81 lesions that implied sick leaves were registered per team and season, causing an average of 11.3 days of absence per lesion. Of these, 11.9% of all the lesions studied were recurrent, causing longer sick leave periods than the ones due to the initial lesions and reaching an average of 17.9 days of sick leave per lesion. 84.4% of the lesions registered were located in the inferior extremities, the thigh being the anatomical region, with 30.5% of all the lesions, the most affected body region. In turn, 53% of the lesions to the thigh occurred in the posterior area, and within the latter, in 73% of the cases, the lesion affected the femoral biceps. In addition, we found a greater frequency of lesions in the dominant leg (54.4% of all the lesions), in contrast with the non dominant leg (36.5% of all the lesions). From the point of view of lesion type the most frequent lesions were muscular (49.1% of all cases), followed by ligament lesions (15.1%). Most of the lesions were produced during moments in which the players were not in physical contact at the moment of suffering the injury (69.1%), in comparison with those produced when there was physical contact (30.9%). With relation to the instance in which the injuries were produced along the season, we found that those lesions suffered during training were progressively less frequent as the season wore on, whilst those suffered during competitions gradually incremented, being the last months of the season when most of the injuries were registered. From the research of this study, we propose the need to carry out more research in this same line, focalizing on some more concrete aspects, which, through our results, we have been able to realize that would be interesting to study in greater depth, and that in the future, our results may have a practical application, helping reduce the incidence of injuries that exist in this sport practice.

Short tandem repeat profiling provides an international reference standard for human cell lines

Cross-contamination between cell lines is a longstanding and frequent cause of scientific misrepresentation. Estimates from national testing services indicate that up to 36% of cell lines are of a different origin or species to that claimed. To test a standard method of cell line authentication, 253 human cell lines from banks and research institutes worldwide were analyzed by short tandem repeat profiling. The short tandem repeat profile is a simple numerical code that is reproducible between laboratories, is inexpensive, and can provide an international reference standard for every cell line. If DNA profiling of cell lines is accepted and demanded internationally, scientific misrepresentation because of cross-contamination can be largely eliminated.

Lyra: uma função de derivação de chaves com custos de memória e processamento configuráveis.

Este documento apresenta o Lyra, um novo esquema de derivação de chaves, baseado em esponjas criptográficas. O Lyra foi projetado para ser estritamente sequencial, fornecendo um nível elevado de segurança mesmo contra atacantes que utilizem múltiplos núcleos de processamento, como uma GPU ou FPGA. Ao mesmo tempo possui uma implementação simples em software e permite ao usuário legítimo ajustar o uso de memória e tempo de processamento de acordo com o nível de segurança desejado. O Lyra é, então, comparado ao scrypt, mostrando que esta proposta fornece um nível se segurança mais alto, além de superar suas deficiências. Caso o atacante deseje realizar um ataque utilizando pouca memória, o tempo de processamento do Lyra cresce exponencialmente, enquanto no scrypt este crescimento é apenas quadrático. Além disto, para o mesmo tempo de processamento, o Lyra permite uma utilização maior de memória, quando comparado ao scrypt, aumentando o custo de ataques de força bruta.

Georges de La Tour : the Status of Scholarship

Seventeenth-century French painter, Georges de La Tour, was a forgotten artist. His rediscovery in the nineteenth century set off a firestorm of research and a hunt to find more works by the artist. One problem after another arose as scholars attempted to define the artist by his works, his style, and the remnants of his personal history. There remains a volume of contradictory reports, authentication issues, and new scientific techniques which continue to influence study on the artist.

An integral security kernel

As the user base of the Internet has grown tremendously, the need for secure services has increased accordingly. Most secure protocols, in digital business and other fields, use a combination of symmetric and asymmetric cryptography, random generators and hash functions in order to achieve confidentiality, integrity, and authentication. Our proposal is an integral security kernel based on a powerful mathematical scheme from which all of these cryptographic facilities can be derived. The kernel requires very little resources and has the flexibility of being able to trade off speed, memory or security; therefore, it can be efficiently implemented in a wide spectrum of platforms and applications, either software, hardware or low cost devices. Additionally, the primitives are comparable in security and speed to well known standards.

Trombocitopenia imune primária crónica : palavra-passe incompleta

Trabalho Final do Curso de Mestrado Integrado em Medicina, Faculdade de Medicina, Universidade de Lisboa, 2014

Advanced computing for systems biology

Systems biology is based on computational modelling and simulation of large networks of interacting components. Models may be intended to capture processes, mechanisms, components and interactions at different levels of fidelity. Input data are often large and geographically disperse, and may require the computation to be moved to the data, not vice versa. In addition, complex system-level problems require collaboration across institutions and disciplines. Grid computing can offer robust, scaleable solutions for distributed data, compute and expertise. We illustrate some of the range of computational and data requirements in systems biology with three case studies: one requiring large computation but small data (orthologue mapping in comparative genomics), a second involving complex terabyte data (the Visible Cell project) and a third that is both computationally and data-intensive (simulations at multiple temporal and spatial scales). Authentication, authorisation and audit systems are currently not well scalable and may present bottlenecks for distributed collaboration particularly where outcomes may be commercialised. Challenges remain in providing lightweight standards to facilitate the penetration of robust, scalable grid-type computing into diverse user communities to meet the evolving demands of systems biology.

A Z based approach to verifying security protocols

Security protocols preserve essential properties, such as confidentiality and authentication, of electronically transmitted data. However, such properties cannot be directly expressed or verified in contemporary formal methods. Via a detailed example, we describe the phases needed to formalise and verify the correctness of a security protocol in the state-oriented Z formalism.

Formal verification of type flaw attacks in security protocols

Security protocols are often modelled at a high level of abstraction, potentially overlooking implementation-dependent vulnerabilities. Here we use the Z specification language's rich set of data structures to formally model potentially ambiguous messages that may be exploited in a 'type flaw' attack. We then show how to formally verify whether or not such an attack is actually possible in a particular protocol using Z's schema calculus.

Articulating wider smartphone emerging security issues in the case of M-government in Turkey

For the last several years, mobile devices and platform security threats, including wireless networking technology, have been top security issues. A departure has occurred from automatic anti-virus software based on traditional PC defense: risk management (authentication and encryption), compliance, and disaster recovery following polymorphic viruses and malware as the primary activities within many organizations and government services alike. This chapter covers research in Turkey as a reflection of the current market – e-government started officially in 2008. This situation in an emerging country presents the current situation and resistances encountered while engaging with mobile and e-government interfaces. The authors contend that research is needed to understand more precisely security threats and most of all potential solutions for sustainable future intention to use m-government services. Finally, beyond m-government initiatives' success or failure, the mechanisms related to public administration mobile technical capacity building and security issues are discussed.

Cryptographic techniques for personal communication systems security

The advent of personal communication systems within the last decade has depended upon the utilization of advanced digital schemes for source and channel coding and for modulation. The inherent digital nature of the communications processing has allowed the convenient incorporation of cryptographic techniques to implement security in these communications systems. There are various security requirements, of both the service provider and the mobile subscriber, which may be provided for in a personal communications system. Such security provisions include the privacy of user data, the authentication of communicating parties, the provision for data integrity, and the provision for both location confidentiality and party anonymity. This thesis is concerned with an investigation of the private-key and public-key cryptographic techniques pertinent to the security requirements of personal communication systems and an analysis of the security provisions of Second-Generation personal communication systems is presented. Particular attention has been paid to the properties of the cryptographic protocols which have been employed in current Second-Generation systems. It has been found that certain security-related protocols implemented in the Second-Generation systems have specific weaknesses. A theoretical evaluation of these protocols has been performed using formal analysis techniques and certain assumptions made during the development of the systems are shown to contribute to the security weaknesses. Various attack scenarios which exploit these protocol weaknesses are presented. The Fiat-Sharmir zero-knowledge cryptosystem is presented as an example of how asymmetric algorithm cryptography may be employed as part of an improved security solution. Various modifications to this cryptosystem have been evaluated and their critical parameters are shown to be capable of being optimized to suit a particular applications. The implementation of such a system using current smart card technology has been evaluated.

Digital image watermarking

In recent years, interest in digital watermarking has grown significantly. Indeed, the use of digital watermarking techniques is seen as a promising mean to protect intellectual property rights of digital data and to ensure the authentication of digital data. Thus, a significant research effort has been devoted to the study of practical watermarking systems, in particular for digital images. In this thesis, a practical and principled approach to the problem is adopted. Several aspects of practical watermarking schemes are investigated. First, a power constaint formulation of the problem is presented. Then, a new analysis of quantisation effects on the information rate of digital watermarking scheme is proposed and compared to other approaches suggested in the literature. Subsequently, a new information embedding technique, based on quantisation, is put forward and its performance evaluated. Finally, the influence of image data representation on the performance of practical scheme is studied along with a new representation based on independent component analysis.