基于UML和模型检测的安全模型验证方法

安全策略的形式化分析与验证随着安全操作系统研究的不断深入已成为当前的研究热点之一.文中在总结前人工作的基础上,首次提出一种基于UML和模型检测器的安全模型验证方法.该方法采用UML将安全策略模型描述为状态机图和类图,然后利用转换工具将UML图转化为模型检测器的输入语言,最后由模型检测器来验证安全模型对于安全需求的满足性.作者使用该方法验证了DBLP和SLCF模型对机密性原则的违反.

Arquitetura para execução segura de workflows de eGovernment dinâmicos

A integração de serviços na perspetiva dos cidadãos e empresas e a necessidade de garantir algumas características da Administração Pública como a versatilidade e a competitividade colocam alguns constrangimentos na conceção das arquiteturas de integração de serviços. Para que seja possível integrar serviços de forma a que se garanta a mutabilidade da Administração Pública, é necessário criar dinamicamente workflows. No entanto, a criação de dinâmica de workflows suscita algumas preocupações ao nível da segurança, nomeadamente em relação à privacidade dos resultados produzidos durante a execução de um workflow e em relação à aplicação de políticas de controlo de participação no workflow pelos diversos executores do mesmo. Neste trabalho apresentamos um conjunto de princípios e regras (arquitetura) que permitem a criação e execução de workflows dinâmicos resolvendo, através de um modelo de segurança, as questões referidas. A arquitetura utiliza a composição de serviços para dessa forma construir serviços complexos a que poderá estar inerente um workflow dinâmico. A arquitetura usa ainda um paradigma de troca de mensagens-padrão entre os prestadores de serviços envolvidos num workflow dinâmico. O modelo de segurança proposto está intimamente ligado ao conjunto de mensagens definido na arquitetura. No âmbito do trabalho foram identificadas e analisadas várias arquiteturas e/ou plataformas de integração de serviços. A análise realizada teve como objetivo identificar as arquiteturas que permitem a criação de workflows dinâmicos e, destas, aquelas que utilizam mecanismos de privacidade para os resultados e de controlo de participação dos executores desses workflows. A arquitetura de integração que apresentamos é versátil, escalável, permite a prestação concorrente de serviços entre prestadores de serviços e permite criar workflows dinâmicos. A arquitetura permite que as entidades executoras do workflow decidam sobre a sua participação, decidam sobre a participação de terceiros (a quem delegam serviços) e decidam a quem entregam os resultados. Os participantes são acreditados por entidades certificadores reconhecidas pelos demais participantes. As credenciais fornecidas pelas entidades certificadoras são o ponto de partida para a aplicação de políticas de segurança no âmbito da arquitetura. Para validar a arquitetura proposta foram identificados vários casos de uso que exemplificam a necessidade de construção de workflows dinâmicos para atender a serviços complexos (não prestados na íntegra por uma única entidade). Estes casos de uso foram implementados num protótipo da arquitetura desenvolvido para o efeito. Essa experimentação permitiu concluir que a arquitetura está adequada para prestar esses serviços usando workflows dinâmicos e que na execução desses workflows os executores dispõem dos mecanismos de segurança adequados para controlar a sua participação, a participação de terceiros e a privacidade dos resultados produzidos no âmbito dos mesmos.

Geofencing Components and Existing Models

This paper describes the various Geofencing Components and Existing Models in terms of their Information Security Control Attribute Profiles. The profiles will dictate the security attributes that should accompany each and every Geofencing Model used for Wi-Fi network security control in an organization, thus minimizing the likelihood of malfunctioning security controls. Although it is up to an organization to investigate the best way of implementing information security for itself, by looking at the related models that have been used in the past this paper will present models commonly used to implement information security controls in the organizations. Our findings will highlight the strengths and weaknesses of the various models and present what our experiment and prototype consider as a robust Geofencing Security Model for securing Wi-Fi Networks

Seguridad nacional: el realismo y sus contradictores

Este artículo ofrece una guía teórica para la investigación actual sobre el concepto de seguridad nacional enfocándose en el realismo y sus críticos –liberalismo y teoría crítica. Debido a que la seguridad nacional usualmente ha sido entendida en términos militares en relación con las circunstancias políticas internacionales, es necesario seguir una discusión axiológica que permita analizar el amplio rango de las diferentes manifestaciones de este asunto. Si ello no es considerado, tanto la actividad académica como la política caerán en una profunda oscuridad, especialmente en los países en los que el espíritu de la doctrina militar ha sido hegemónico. En este orden de ideas, en la primera parte, este trabajo explora las premisas de la escuela realista y su visión sobre el modelo de seguridad nacional. La segunda parte examina la aproximación liberal y, especialmente, su propuesta de cambiar el nivel de análisis nacional del realismo. La tercera parte explora los estudios críticos de seguridad y su relación con la teoría crítica con el propósito de esbozar su crítica epistemológica al realismo como una teoría racionalista.-----This article offers theoretical guidelines for the current national security concept research focused on realism and its critics –liberalism and critical theory. Due to the usual understanding of the national security on a military basis with respect to the international political situation, an axiological discussion is required to analyze the wide range of the different aspects of this matter. If not considered, both academic and political activities will be deeply darkened, particularly in those countries where the military doctrine spirit has been hegemonic. In this regard, the first part of this paper explores the premises of the realistic school and their view on the national security model. The second part examines the liberal approach and, in particular, its proposed change of level of the national realism analysis. The third part explores the Critical Security Studies and the relation they keep with the critical theory with the purpose to outline its epistemic criticism to the realism as a rationalistic theory.

Further observations on certificateless public key encryption

Certificateless public key encryption can be classified into two types, namely, CLE and CLE † , both of which were introduced by Al-Riyami and Paterson in Asiacrypt 2003. Most works about certificateless public key encryption belong to CLE, where the partial secret key is uniquely determined by an entity’s identity. In CLE † , an entity’s partial secret key is not only determined by the identity information but also by his/her (partial) public key. Such techniques can enhance the resilience of certificateless public key encryption against a cheating KGC. In this paper, we first formalize the security definitions of CLE † . After that, we demonstrate the gap between the security model of CLE † and CLE, by showing the insecurity of a CLE † scheme proposed by Lai and Kou in PKC 2007. We give an attack that can successfully break the indistinguishability of their CLE † scheme, although their scheme can be proved secure in the security model of CLE. Therefore, it does not suffice to consider the security of CLE † in the security model of CLE. Finally, we show how to secure Lai-Kou’s scheme by providing a new scheme with the security proof in the model of CLE †

Certificate-based signatures: New definitions and a generic construction from certificateless signatures

Certificate-based encryption was introduced in Eurocrypt’03 to solve the certificate management problem in public key encryption. Recently, this idea has been extended to certificate-based signatures. To date, several new schemes and security models of certificate-based signatures have been proposed. In this paper, we first introduce a new security model of certificate-based signatures. Our model is not only more elaborated when compared with the existing ones, but also defines several new types of adversaries in certificate-based signatures. We then investigate the relationship between certificate-based signatures and certificateless signatures, by proposing a generic construction of certificate-based signatures from certificateless signatures. Our generic construction is secure (in the random oracle model) under the security model defined in this paper, assuming the underlying certificateless signatures satisfying certain security notions.

Efficient and short certificateless signatures secure against realistic adversaries

The notion of certificateless cryptography is aimed to eliminate the use of certificates in traditional public key cryptography and also to solve the key-escrow problem in identity-based cryptography. Many kinds of security models have been designed for certificateless cryptography and many new schemes have been introduced based on the correspondence of the security models. In generally speaking, a stronger security model can ensure a certificateless cryptosystem with a higher security level, but a realistic model can lead to a more efficient scheme. In this paper, we focus on the efficiency of a certificateless signature (CLS) scheme and introduce an efficient CLS scheme with short signature size. On one hand, the security of the scheme is based on a realistic model. In this model, an adversary is not allowed to get any valid signature under false public keys. On the other hand, our scheme is as efficient as BLS short signature scheme in both communication and computation and, therefore, turns out to be more efficient than other CLS schemes proposed so far. We provide a rigorous security proof of our scheme in the random oracle model. The security of our scheme is based on the k-CAA hard problem and a new discovered hard problem, namely the modified k-CAA problem. Our scheme can be applied to systems where signatures are typed in by human or systems with low-bandwidth channels and/or low-computation power.

Certificate-based signatures revisited

Certificate-based encryption was introduced in Eurocrypt '03 to solve the certificate management problem in public key encryption. Recently, this idea was extended to certificate-based signatures. Several new schemes and security models of certificate-based signature by comparing it with digital signatures in other popular public key systems. We introduce a new security model of certificate-based signature, which defines several new types of adversaries against certificate-based signature, which defines several new types of adversaries against certificate-based signatures, along with the security model of certificate-based signatures against them. The new model is clearer and more elaborated compared with other existing ones. We then investigate the relationship between certificate-based signatures and certificate-less signatures, and propose a generic construction of certificate-based signatures and certificate less signatures, and propose a generic construction of certificate-based signatures. We prove that the generic construction is secure (in the random oracle model) against all types of adversaries defined in this paper, assuming the underlying certificateless signatures satisfying certain security notions. Based on our generic construction, we are able to construct new certificate-based signatures schemes, which are more effiecient in comparison with other schemes with similar security levels

A provably secure construction of certificate-based encryption from certificateless encryption

Certificate-based encryption (CBE) and certificateless encryption (CLE) are proposed to lessen the certificate management problem in a traditional public-key encryption setting. Although they are two different notions, CBE and CLE are closely related and possess several common features. The encryption in CBE and CLE does not require authenticity verification of the recipient's public key. The decryption in both notions requires two secrets that are generated by the third party and the public key owner, respectively. Recently a generic conversion from CLE to CBE was given, but unfortunately its security proof is flawed. This paper provides an elaborate security model of CBE, based on which a provably secure generic construction of CBE from CLE is proposed. A concrete instantiation is also presented to demonstrate the application of our generic construction.

Secure outsourced attribute-based signatures

Attribute-based signature (ABS) enables users to sign messages over attributes without revealing any information other than the fact that they have attested to the messages. However, heavy computational cost is required during signing in existing work of ABS, which grows linearly with the size of the predicate formula. As a result, this presents a significant challenge for resource-constrained devices (such as mobile devices or RFID tags) to perform such heavy computations independently. Aiming at tackling the challenge above, we first propose and formalize a new paradigm called Outsourced ABS, i.e., OABS, in which the computational overhead at user side is greatly reduced through outsourcing intensive computations to an untrusted signing-cloud service provider (S-CSP). Furthermore, we apply this novel paradigm to existing ABS schemes to reduce the complexity. As a result, we present two concrete OABS schemes: i) in the first OABS scheme, the number of exponentiations involving in signing is reduced from O(d) to O(1) (nearly three), where d is the upper bound of threshold value defined in the predicate; ii) our second scheme is built on Herranz et al.'s construction with constant-size signatures. The number of exponentiations in signing is reduced from O(d2) to O(d) and the communication overhead is O(1). Security analysis demonstrates that both OABS schemes are secure in terms of the unforgeability and attribute-signer privacy definitions specified in the proposed security model. Finally, to allow for high efficiency and flexibility, we discuss extensions of OABS and show how to achieve accountability as well.

Secure distributed deduplication systems with improved reliability

Data deduplication is a technique for eliminating duplicate copies of data, and has been widely used in cloud storage to reduce storage space and upload bandwidth. However, there is only one copy for each file stored in cloud even if such a file is owned by a huge number of users. As a result, deduplication system improves storage utilization while reducing reliability. Furthermore, the challenge of privacy for sensitive data also arises when they are outsourced by users to cloud. Aiming to address the above security challenges, this paper makes the first attempt to formalize the notion of distributed reliable deduplication system. We propose new distributed deduplication systems with higher reliability in which the data chunks are distributed across multiple cloud servers. The security requirements of data confidentiality and tag consistency are also achieved by introducing a deterministic secret sharing scheme in distributed storage systems, instead of using convergent encryption as in previous deduplication systems. Security analysis demonstrates that our deduplication systems are secure in terms of the definitions specified in the proposed security model. As a proof of concept, we implement the proposed systems and demonstrate that the incurred overhead is very limited in realistic environments.

A previdência rural universalista e a sua relevância na economia dos municípios do Rio Grande do Norte

This study deals with the rural social security Universalist established by the Constitution of 1988 and its importance in the economy of the municipalities of Rio Grande do Norte. In this context, the study seeks to satisfy two important criteria that guide the selection of objects of social science research: a consideration of issues that have relevance to the real world and the intention to make the contribution to the scholarly literature on theoretical and empirical aspects. The research seeks to reveal what is the economic importance of the subsystem of social security for rural municipalities in RN. The hypothesis is that the transfer of income received by beneficiaries from the rural social security tax exceeds the explicit mechanisms for most municipalities in RN, in many cases significantly, proving the importance of this policy as a mechanism for combating poverty and reducing social inequality, especially before the fragility of the federal system on the national political entity hall. The study presents theoretical cores - chapters 1-3 - and empirical - Chapter 4. The first core is about the evolution of social protection as a state policy, addressing the influential theories and typologies of the State of Social Welfare and the characteristics of the Brazilian social security model, but mainly, its rural social security subsystem, its history until universalistic model inaugurated by the Federal Constitution of 1988. The second begins with an overview of studies that have emphasized the impact of Social Security on the local economy of small municipalities, then passing data and statistics in order to gauge the socioeconomic importance of pension income in the rural municipalities of Rio Grande do Norte. To this end, the final chapter provides a comparison of the monetary value transferred by the payment of social security benefits - rural and urban - to each of the 167 municipalities in RN with the equally important sources of income in the budget of municipal entities. Apart from their own tax revenues, are objects of comparison with the value of pension benefits awarded in RN, transfer quota state relating to the municipality on the federal ICMS and the transfer on the FPM

Ações regressivas acidentárias sob a perspectiva da previdênca social e da responsabilidade civil

Pós-graduação em Direito - FCHS

Contribution to the improvement of communication services in nanosatellite constellations using delay and disruption tolerant networking based architectures

Esta tesis se desarrolla dentro del marco de las comunicaciones satelitales en el innovador campo de los pequeños satélites también llamados nanosatélites o cubesats, llamados así por su forma cubica. Estos nanosatélites se caracterizan por su bajo costo debido a que usan componentes comerciales llamados COTS (commercial off-the-shelf) y su pequeño tamaño como los Cubesats 1U (10cm*10 cm*10 cm) con masa aproximada a 1 kg. Este trabajo de tesis tiene como base una iniciativa propuesta por el autor de la tesis para poner en órbita el primer satélite peruano en mi país llamado chasqui I, actualmente puesto en órbita desde la Estación Espacial Internacional. La experiencia de este trabajo de investigación me llevo a proponer una constelación de pequeños satélites llamada Waposat para dar servicio de monitoreo de sensores de calidad de agua a nivel global, escenario que es usado en esta tesis. Es ente entorno y dadas las características limitadas de los pequeños satélites, tanto en potencia como en velocidad de datos, es que propongo investigar una nueva arquitectura de comunicaciones que permita resolver en forma óptima la problemática planteada por los nanosatélites en órbita LEO debido a su carácter disruptivo en sus comunicaciones poniendo énfasis en las capas de enlace y aplicación. Esta tesis presenta y evalúa una nueva arquitectura de comunicaciones para proveer servicio a una red de sensores terrestres usando una solución basada en DTN (Delay/Disruption Tolerant Networking) para comunicaciones espaciales. Adicionalmente, propongo un nuevo protocolo de acceso múltiple que usa una extensión del protocolo ALOHA no ranurado, el cual toma en cuenta la prioridad del trafico del Gateway (ALOHAGP) con un mecanismo de contienda adaptativo. Utiliza la realimentación del satélite para implementar el control de la congestión y adapta dinámicamente el rendimiento efectivo del canal de una manera óptima. Asumimos un modelo de población de sensores finito y una condición de tráfico saturado en el que cada sensor tiene siempre tramas que transmitir. El desempeño de la red se evaluó en términos de rendimiento efectivo, retardo y la equidad del sistema. Además, se ha definido una capa de convergencia DTN (ALOHAGP-CL) como un subconjunto del estándar TCP-CL (Transmission Control Protocol-Convergency Layer). Esta tesis muestra que ALOHAGP/CL soporta adecuadamente el escenario DTN propuesto, sobre todo cuando se utiliza la fragmentación reactiva. Finalmente, esta tesis investiga una transferencia óptima de mensajes DTN (Bundles) utilizando estrategias de fragmentación proactivas para dar servicio a una red de sensores terrestres utilizando un enlace de comunicaciones satelitales que utiliza el mecanismo de acceso múltiple con prioridad en el tráfico de enlace descendente (ALOHAGP). El rendimiento efectivo ha sido optimizado mediante la adaptación de los parámetros del protocolo como una función del número actual de los sensores activos recibidos desde el satélite. También, actualmente no existe un método para advertir o negociar el tamaño máximo de un “bundle” que puede ser aceptado por un agente DTN “bundle” en las comunicaciones por satélite tanto para el almacenamiento y la entrega, por lo que los “bundles” que son demasiado grandes son eliminados o demasiado pequeños son ineficientes. He caracterizado este tipo de escenario obteniendo una distribución de probabilidad de la llegada de tramas al nanosatélite así como una distribución de probabilidad del tiempo de visibilidad del nanosatélite, los cuales proveen una fragmentación proactiva óptima de los DTN “bundles”. He encontrado que el rendimiento efectivo (goodput) de la fragmentación proactiva alcanza un valor ligeramente inferior al de la fragmentación reactiva. Esta contribución permite utilizar la fragmentación activa de forma óptima con todas sus ventajas tales como permitir implantar el modelo de seguridad de DTN y la simplicidad al implementarlo en equipos con muchas limitaciones de CPU y memoria. La implementación de estas contribuciones se han contemplado inicialmente como parte de la carga útil del nanosatélite QBito, que forma parte de la constelación de 50 nanosatélites que se está llevando a cabo dentro del proyecto QB50. ABSTRACT This thesis is developed within the framework of satellite communications in the innovative field of small satellites also known as nanosatellites (<10 kg) or CubeSats, so called from their cubic form. These nanosatellites are characterized by their low cost because they use commercial components called COTS (commercial off-the-shelf), and their small size and mass, such as 1U Cubesats (10cm * 10cm * 10cm) with approximately 1 kg mass. This thesis is based on a proposal made by the author of the thesis to put into orbit the first Peruvian satellite in his country called Chasqui I, which was successfully launched into orbit from the International Space Station in 2014. The experience of this research work led me to propose a constellation of small satellites named Waposat to provide water quality monitoring sensors worldwide, scenario that is used in this thesis. In this scenario and given the limited features of nanosatellites, both power and data rate, I propose to investigate a new communications architecture that allows solving in an optimal manner the problems of nanosatellites in orbit LEO due to the disruptive nature of their communications by putting emphasis on the link and application layers. This thesis presents and evaluates a new communications architecture to provide services to terrestrial sensor networks using a space Delay/Disruption Tolerant Networking (DTN) based solution. In addition, I propose a new multiple access mechanism protocol based on extended unslotted ALOHA that takes into account the priority of gateway traffic, which we call ALOHA multiple access with gateway priority (ALOHAGP) with an adaptive contention mechanism. It uses satellite feedback to implement the congestion control, and to dynamically adapt the channel effective throughput in an optimal way. We assume a finite sensor population model and a saturated traffic condition where every sensor always has frames to transmit. The performance was evaluated in terms of effective throughput, delay and system fairness. In addition, a DTN convergence layer (ALOHAGP-CL) has been defined as a subset of the standard TCP-CL (Transmission Control Protocol-Convergence Layer). This thesis reveals that ALOHAGP/CL adequately supports the proposed DTN scenario, mainly when reactive fragmentation is used. Finally, this thesis investigates an optimal DTN message (bundles) transfer using proactive fragmentation strategies to give service to a ground sensor network using a nanosatellite communications link which uses a multi-access mechanism with priority in downlink traffic (ALOHAGP). The effective throughput has been optimized by adapting the protocol parameters as a function of the current number of active sensors received from satellite. Also, there is currently no method for advertising or negotiating the maximum size of a bundle which can be accepted by a bundle agent in satellite communications for storage and delivery, so that bundles which are too large can be dropped or which are too small are inefficient. We have characterized this kind of scenario obtaining a probability distribution for frame arrivals to nanosatellite and visibility time distribution that provide an optimal proactive fragmentation of DTN bundles. We have found that the proactive effective throughput (goodput) reaches a value slightly lower than reactive fragmentation approach. This contribution allows to use the proactive fragmentation optimally with all its advantages such as the incorporation of the security model of DTN and simplicity in protocol implementation for computers with many CPU and memory limitations. The implementation of these contributions was initially contemplated as part of the payload of the nanosatellite QBito, which is part of the constellation of 50 nanosatellites envisaged under the QB50 project.

Sistema Nacional de Salud español. Características y análisis

La Ley General de Sanidad 14/1986 de 25 de Abril posibilitó el tránsito del antiguo modelo de Seguridad Social al actual modelo de Sistema Nacional de Salud (SNS), financiado con impuestos y de cobertura prácticamente universal. Desde entonces se han producido profundos cambios en el sistema que culminaron en el año 2002 con la descentralización total de competencias en materia de salud en las Comunidades Autónomas. La regulación nacional de competencias en materia de salud se realiza desde el Consejo Interterritorial del Sistema Nacional de Salud, organismo que agrupa a los máximos responsables autonómicos en materia de salud de cada Comunidad Autónoma y que tiene entre otras, la responsabilidad de evitar las desigualdades en servicios sanitarios dentro del territorio nacional. La creación y competencias del Consejo Interterritorial quedan recogidas en la Ley 16/2003 de 28 de mayo de Cohesión de la calidad del Sistema Nacional de Salud. La cartera de servicios comunes del SNS se establece en el Real Decreto 1030/2006 de 15 de Septiembre, actualizando el Real Decreto 63/1995 de 20 de enero sobre Ordenación de las prestaciones sanitarias, resultando del actual marco legislativo con la descentralización de competencias y gestión de los presupuestos un horizonte de posible variabilidad en los modelos de gestión de cada CCAA, que, si bien deben garantizar la universalidad de las prestaciones, también ofrece una diversidad de modalidades de gestionar los recursos en materia de salud. En cuanto al estado de salud de los españoles, destacar que la esperanza de vida al nacer se sitúa en 79,9 años, superior a la media europea, 78,3 años, y la esperanza de vida ajustada por incapacidad fue en 2002 de 72,6 años en España respecto a los 70,8 de la UE. Según cifras del propio Ministerio de Sanidad, la percepción de la salud de los ciudadanos fue positiva para un 73% de los hombres y un 63,2 de las mujeres. Alrededor del 60% de la población tiene un peso normal y la morbilidad sitúa en los primeros lugares las enfermedades del aparato circulatorio, el cáncer y las enfermedades del aparato respiratorio (CIE-9). El gasto sanitario en España, es un capítulo presupuestario importante, al situarse en torno al 7,5 del P.I.B, y los recursos e inversiones presentan aparentes desigualdades autonómicas. Los modelos de gestión y dependencia patrimonial de los recursos, variables entre Autonomías, plantean la necesidad de monitorizar un seguimiento que permita evaluar en los próximos diez años el impacto de la descentralización de competencias del Sistema. La estructura del Sistema tiene dos niveles asistenciales mayoritarios, atención primaria y especializada, absorbiendo la atención especializada la mayor parte del presupuesto. El incremento del gasto sanitario y la universalidad de las prestaciones han condicionado en gran medida la implantación de modelos de gestión diferentes a los tradicionales. Esta situación no es exclusiva del Estado Español. En los Estados del entorno de la Unión Europea, el Consejo de Ministros de Sanidad de la UE en su sesión celebrada los días 1 y 2 de Junio de 200625 concluyeron un documento que recoge los valores y principios comunes de los sistemas sanitarios de los países de la Unión Europea, resaltando los principios y valores de los sistemas sanitarios como soporte estructural de dichos estados. Como conclusión, en este momento (2007) el Sistema Nacional de Salud Español, está inmerso en un proceso de trasformación orientado a garantizar la eficiencia de las prestaciones de manera responsable, es decir, ofertar al ciudadano la mejor calidad de servicios al mínimo coste.