Security analysis of JXME-Proxyless version

JXME es la especificación de JXTA para dispositivos móviles con J2ME. Hay dos versiones diferentes de la aplicación JXME disponibles, cada una específica para un determinado conjunto de dispositivos, de acuerdo con sus capacidades. El principal valor de JXME es su simplicidad para crear peer-to-peer (P2P) en dispositivos limitados. Además de evaluar las funciones JXME, también es importante tener en cuenta el nivel de seguridad por defecto que se proporciona. Este artículo presenta un breve análisis de la situación actual de la seguridad en JXME, centrándose en la versión JXME-Proxyless, identifica las vulnerabilidades existentes y propone mejoras en este campo.

A security layer for JXTA core protocols

JXTA define un conjunto de seis protocolos básicos especialmente adecuados para una computación ad hoc, permanente, multi-hop, peer-to-peer (P2P). Estos protocolos permiten que los iguales cooperen y formen grupos autónomos de pares. Este artículo presenta un método que proporciona servicios de seguridad en los protocolos básicos: protección de datos, autenticidad, integridad y no repudio. Los mecanismos que se presentan son totalmente distribuidos y basados ¿¿en un modelo puro peer-to-peer, que no requieren el arbitraje de un tercero de confianza o una relación de confianza establecida previamente entre pares, que es uno de los principales retos en este tipo de entornos.

A Security-aware Approach to JXTA-Overlay Primitives

The JXTA-Overlay project is an effort to use JXTA technologyto provide a generic set of functionalities that can be used by developers to deploy P2P applications. Since its design mainly focuses on issues such as scalability or overall performance, it does not take security into account. However, as P2P applications have evolved to fulfill more complex scenarios, security has become a very important aspect to take into account when evaluating a P2P framework. This work proposes a security extension specifically suited to JXTA-Overlay¿s idiosyncrasies, providing an acceptable solution to some of its current shortcomings.

ZigBee/ZigBee PRO security assessment based on compromised cryptographic keys

Sensor networks have many applications in monitoring and controlling of environmental properties such as sound, acceleration, vibration and temperature. Due to limitedresources in computation capability, memory and energy, they are vulnerable to many kinds of attacks. The ZigBee specification based on the 802.15.4 standard, defines a set of layers specifically suited to sensor networks. These layers support secure messaging using symmetric cryptographic. This paper presents two different ways for grabbing the cryptographic key in ZigBee: remote attack and physical attack. It also surveys and categorizes some additional attacks which can be performed on ZigBee networks: eavesdropping, spoofing, replay and DoS attacks at different layers. From this analysis, it is shown that some vulnerabilities still in the existing security schema in ZigBee technology.

A Security Framework for JXTA-Overlay

En l'actualitat, la maduresa del camp de la investigació P2P empès a través de nous problemes, relacionats amb la seguretat. Per aquesta raó, la seguretat comença a convertir-se en una de les qüestions clau en l'avaluació d'un sistema P2P, i és important proporcionar mecanismes de seguretat per a sistemes P2P. El projecte JXTAOverlay fa un esforç per utilitzar la tecnologia JXTA per proporcionar un conjunt genèric de funcions que poden ser utilitzades pels desenvolupadors per desplegar aplicacions P2P. No obstant això, encara que el seu disseny es va centrar en qüestions com ara l'escalabilitat o el rendiment general, no va tenir en compte la seguretat. Aquest treball proposa un marc de seguretat, adaptat específicament a la idiosincràsia del JXTAOverlay.

JXTA security in mobile constrained devices

JXME is the JXTA protocols implementation formobile devices using J2ME. Two different flavors of JXME have been implemented, each one specific for a particular set of devices, according to their capabilities. The main value of JXME is its simplicity to create peer-to-peer (P2P) applications in limited devices. In addition to assessing JXME functionalities, it is also important to realize the default security level provided. This paper presents a brief analysis of the current state of security in JXME, focusing on the JXME-Proxied version, identifies existing vulnerabilities and proposes further improvements in this field.

Open Source Software : the Intersection of IP and Security in Open Source

The use of open source software continues to grow on a daily basis. Today, enterprise applications contain 40% to 70% open source code and this fact has legal, development, IT security, risk management and compliance organizations focusing their attention on its use, as never before. They increasingly understand that the open source content within an application must be detected. Once uncovered, decisions regarding compliance with intellectual property licensing obligations must be made and known security vulnerabilities must be remediated. It is no longer sufficient from a risk perspective to not address both open source issues.

Description des possibilités et difficultés d'utilisation des dossiers de l'assurance invalidité à des fins de recherche en pédiatrie.

Afin que la base de données de l'assurance invalidite (AI) soit utilisable à des fins de recherche, il serait nécessaire de restructurer le mode de récolte de données; unifier les définitions de l'impotence et de l'invalidité utilisées à l'AI avec celles de l'Organisation mondiale de la sante (OMS); employer les codes de la classification internationale des maladies (CIM); organiser le système de telle manière qu'il soit possible d'obtenir des listes d'assurés par année de naissance, par année d'entrée à l'AI, par diagnostic et par année d'âge.

High prevalence of forgoing healthcare for economic reasons in Switzerland: a population-based study in a region with universal health insurance coverage.

OBJECTIVE: To investigate the determinants and the 4-year evolution of the forgoing of healthcare for economic reasons in Switzerland. METHOD: Population-based survey (2007-2010) of a representative sample aged 35-74years in the Canton of Geneva, Switzerland. Healthcare forgone, socioeconomic and insurance status, marital status, and presence of dependent children were assessed using standardized methods. RESULTS: A total of 2601 subjects were included in the analyses. Of the subjects, 13.8% (358/2601) reported having forgone healthcare for economic reasons, with the percentage varying from 3.7% in the group with a monthly income ≥13,000CHF (1CHF≈1$) to 30.9% in the group with a monthly income <3000CHF. In subjects with a monthly income <3000CHF, the percentage who had forgone healthcare increased from 22.5% in 2007/8 to 34.7% in 2010 (P trend=0.2). Forgoing healthcare for economic reasons was associated with lower income, female gender, smoking status, lower job position, having dependent children, being divorced and single, paying a higher deductible, and receiving a premium subsidy. CONCLUSION: In a Swiss region with universal health insurance coverage, the reported prevalence of forgoing healthcare for economic reasons was high and greatly dependent on socioeconomic factors. Our data suggested an increasing trend among participants with the lowest income.

Insurance coverage of pediatric burns: Switzerland versus USA.

Burn care and research have significantly improved over the past years. However, insurance coverage of such treatments does not reflect the improvements in this multi-disciplinary field. Government insurance policies in first world countries renown for burn care treatment, such as Switzerland and the United States, have not adapted to the complexity and longitudinal nature of burn care. Using case studies from both countries, we have analyzed both the institutional and policy approach to pediatric burn treatment coverage. Subsequently, by presenting the Shriners burn care model, we offer a policy recommendation to both the Swiss and the American governments to better their present legislation and infrastructure on pediatric burn coverage.

Sähköisten reseptien hallinta

Sähköinen reseptijärjestelmä nykyisessä muodossaan sai alkunsa Sosiaali- ja terveysministeriön aloitteesta ja Kansaneläkelaitoksen toimesta vuoden 2001 aikana. Käytössä oleva kansallinen reseptipalvelin mahdollistaa potilaiden oikeudet muun muassa apteekin vapaaseen valintaan ja lääkkeiden suorakorvausmenetelmään. Sähköinen resepti pyritään integroimaan olemassa olevien potilasrekisterijärjestelmien yhteyteen, joten semanttisen webin tuomat teknologiat kuten Web-palvelut ja XML-pohjaiset kielet ovat tärkeässä asemassa reseptien hallinnassa. Tässä työssä pyritään esittämään sähköisen reseptijärjestelmän toimintaa ja sen mahdollistavia jo olemassa olevia tekniikoita. Esille tuodaan myös uusia lisäarvoa tuovia tekniikoita, kuten RDF(S)-kuvauskielet, jotka mahdollistavat muun muassa resepteihin kohdistuvat kyselyt ja täten uudet terveyspalvelut sekä potilaille että lääkäreille. Oleellista on tietenkin myös tietoturva, sillä organisaatioiden välillä resepteissä liikkuu arkaluontoisia tietoja. Turvallisuutta pyritään edistämään muun muassa sähköisillä allekirjoituksilla ja älykorttien avulla tapahtuvalla järjestelmään tunnistautumisella. Jotta sähköinen resepti toimisi tulevaisuudessakin halutulla tavalla ja mahdollistaisi lisäarvopalveluita, on siinä panostettava sisällön lisäksi senkuvaamiseen. Sisällön ja sen suhteiden tarkka määrittely auttaa muun muassa reseptikyselyjen tekemisessä, mikä onkin olennainen osa potilasturvallisuuden ylläpitoa. Kuvauskielien ja ontologioiden käyttö voi myös auttaa lääkehoidon määrittämisessä useiden erilaisten ja jatkuvasti lisääntyvien lääkkeiden viidakossa, kun lääkkeitä voidaan etsiä tietokannoista reseptin kirjoituksen yhteydessä.

Gender and Security Sector Reform: Gendering Differently?

Recent efforts to implement gender mainstreaming in the field of security sector reform have resulted in an international policy discourse on gender and security sector reform (GSSR). Critics have challenged GSSR for its focus on 'adding women' and its failure to be transformative. This article contests this assessment, demonstrating that GSSR is not only about 'adding women', but also, importantly, about 'gendering men differently' and has important albeit problematic transformative implications. Drawing on poststructuralist and postcolonial feminist theory, I propose a critical reading of GSSR policy discourse in order to analyse its built-in logics, tensions and implications. I argue that this discourse establishes a powerful 'grid of intelligibility' that draws on gendered and racialized dualisms to normalize certain forms of subjectivity while rendering invisible and marginalizing others, and contributing to reproduce certain forms of normativity and hierarchy. Revealing such processes of discursive in/exclusion and marginalized subjectivities can serve as a starting point to challenge and transform GSSR practice and identify sites of contestation.