Socioeconomic inequality profiles in physical and developmental health from 0-7 years : Australian National Study

Background: Early and persistent exposure to socioeconomic disadvantage impairs children’s health and wellbeing. However, it is unclear at what age health inequalities emerge or whether these relationships vary across ages and outcomes. We address these issues using cross-sectional Australian population data on the physical and developmental health of children at ages 0-1, 2-3, 4-5 and 6-7 years. Methods: 10 physical and developmental health outcomes were assessed in 2004 and 2006 for two cohorts each comprising around 5000 children. Socioeconomic position was measured as a composite of parental education, occupation and household income. Results: Lower socioeconomic position was associated with increased odds for poor outcomes. For physical health outcomes and socio-emotional competence, associations were similar across age groups and were consistent with either threshold effects (for poor general health, special healthcare needs and socio-emotional competence) or gradient effects (for illness with wheeze, sleep problems and injury). For socio-emotional difficulties, communication, vocabulary and emergent literacy, stronger socioeconomic associations were observed. The patterns were linear or accelerated and varied across ages. Conclusions: From very early childhood, social disadvantage was associated with poorer outcomes across most measures of physical and developmental health and showed no evidence of either strengthening or attenuating at older compared to younger ages. Findings confirm the importance of early childhood as a key focus for health promotion and prevention efforts.

Exposure to ultrafine particles and PM2.5 in four Sydney transport modes

Concentrations of ultrafine (<0.1µm) particles (UFPs) and PM2.5 (<2.5µm) were measured whilst commuting along a similar route by train, bus, ferry and automobile in Sydney, Australia. One trip on each transport mode was undertaken during both morning and evening peak hours throughout a working week, for a total of 40 trips. Analyses comprised one-way ANOVA to compare overall (i.e. all trips combined) geometric mean concentrations of both particle fractions measured across transport modes, and assessment of both the correlation between wind speed and individual trip means of UFPs and PM2.5, and the correlation between the two particle fractions. Overall geometric mean concentrations of UFPs and PM2.5 ranged from 2.8 (train) to 8.4 (bus) × 104 particles cm-3 and 22.6 (automobile) to 29.6 (bus) µg m-3, respectively, and a statistically significant difference (p <0.001) between modes was found for both particle fractions. Individual trip geometric mean concentrations were between 9.7 × 103 (train) and 2.2 × 105 (bus) particles cm-3 and 9.5 (train) to 78.7 (train) µg m-3. Estimated commuter exposures were variable, and the highest return trip mean PM2.5 exposure occurred in the ferry mode, whilst the highest UFP exposure occurred during bus trips. The correlation between fractions was generally poor, and in keeping with the duality of particle mass and number emissions in vehicle-dominated urban areas. Wind speed was negatively correlated with, and a generally poor determinant of, UFP and PM2.5 concentrations, suggesting a more significant role for other factors in determining commuter exposure.

Oxidative potential of logwood and pellet burning particles assessed by a novel profluorescent nitroxide probe

This study reports the potential toxicological impact of particles produced during biomass combustion by an automatic pellet boiler and a traditional logwood stove under various combustion conditions using a novel profluorescent nitroxide probe BPEAnit. This probe is weakly fluorescent, but yields strong fluorescence emission upon radical trapping or redox activity. Samples were collected by bubbling aerosol through an impinger containing BPEAnit solution, followed by fluorescence measurement. The fluorescence of BPEAnit was measured for particles produced during various combustion phases, at the beginning of burning (cold start), stable combustion after refilling with the fuel (warm start) and poor burning conditions. For particles produced by the logwood stove under cold-start conditions significantly higher amounts of reactive species per unit of particulate mass were observed compared to emissions produced during a warm start. In addition, sampling of logwood burning emissions after passing through a thermodenuder at 250oC resulted in an 80-100% reduction of the fluorescence signal of BPEAnit probe, indicating that the majority of reactive species were semivolatile. Moreover, the amount of reactive species showed a strong correlation with the amount of particulate organic material. This indicates the importance of semivolatile organics in particle-related toxicity. Particle emissions from the pellet boiler, although of similar mass concentration, were not observed to lead to an increase in fluorescence signal during any of the combustion phases.

Centrally supported online surveys for research at QUT

We describe the introduction, service growth, benefits and holistic support approach of a centrally supported universitywide online survey tool for researchers at QUT. The online survey service employs the Key Survey software, and has grown into a significant service for QUT researchers since being introduced in 2009. Key benefits of the approach include the ability of QUT to handle important issues relating to data such as security, privacy, integrity, archiving & disposal. The service also incorporates a workflow process that enhances the institution’s ability to ensure survey quality control through controlled approval and pilot testing before any survey is widely released. An important issue is that a tool like this can make it very easy to do very poor research very quickly while creating lots of data, due to the absence of a rigorous methodology designed to reduce errors and collect accurate, comprehensive, timely data. With this in mind, a holistic approach to service provision and support has been taken, which has included the introduction of an integrated system of seminars, tools and workshops to get researchers thinking about the quality of their research while becoming operational quickly. The system of seminars, workshops, checks and approvals we have put in place at QUT is designed to ensure better quality outcomes for QUT’s research and the individual researchers concerned.

The feasibility of vibration analysis as a technique to detect osseointegration of transfemoral implants

One of the main causes of above knee or transfemoral amputation (TFA) in the developed world is trauma to the limb. The number of people undergoing TFA due to limb trauma, particularly due to war injuries, has been increasing. Typically the trauma amputee population, including war-related amputees, are otherwise healthy, active and desire to return to employment and their usual lifestyle. Consequently there is a growing need to restore long-term mobility and limb function to this population. Traditionally transfemoral amputees are provided with an artificial or prosthetic leg that consists of a fabricated socket, knee joint mechanism and a prosthetic foot. Amputees have reported several problems related to the socket of their prosthetic limb. These include pain in the residual limb, poor socket fit, discomfort and poor mobility. Removing the socket from the prosthetic limb could eliminate or reduce these problems. A solution to this is the direct attachment of the prosthesis to the residual bone (femur) inside the residual limb. This technique has been used on a small population of transfemoral amputees since 1990. A threaded titanium implant is screwed in to the shaft of the femur and a second component connects between the implant and the prosthesis. A period of time is required to allow the implant to become fully attached to the bone, called osseointegration (OI), and be able to withstand applied load; then the prosthesis can be attached. The advantages of transfemoral osseointegration (TFOI) over conventional prosthetic sockets include better hip mobility, sitting comfort and prosthetic retention and fewer skin problems on the residual limb. However, due to the length of time required for OI to progress and to complete the rehabilitation exercises, it can take up to twelve months after implant insertion for an amputee to be able to load bear and to walk unaided. The long rehabilitation time is a significant disadvantage of TFOI and may be impeding the wider adoption of the technique. There is a need for a non-invasive method of assessing the degree of osseointegration between the bone and the implant. If such a method was capable of determining the progression of TFOI and assessing when the implant was able to withstand physiological load it could reduce the overall rehabilitation time. Vibration analysis has been suggested as a potential technique: it is a non destructive method of assessing the dynamic properties of a structure. Changes in the physical properties of a structure can be identified from changes in its dynamic properties. Consequently vibration analysis, both experimental and computational, has been used to assess bone fracture healing, prosthetic hip loosening and dental implant OI with varying degrees of success. More recently experimental vibration analysis has been used in TFOI. However further work is needed to assess the potential of the technique and fully characterise the femur-implant system. The overall aim of this study was to develop physical and computational models of the TFOI femur-implant system and use these models to investigate the feasibility of vibration analysis to detect the process of OI. Femur-implant physical models were developed and manufactured using synthetic materials to represent four key stages of OI development (identified from a physiological model), simulated using different interface conditions between the implant and femur. Experimental vibration analysis (modal analysis) was then conducted using the physical models. The femur-implant models, representing stage one to stage four of OI development, were excited and the modal parameters obtained over the range 0-5kHz. The results indicated the technique had limited capability in distinguishing between different interface conditions. The fundamental bending mode did not alter with interfacial changes. However higher modes were able to track chronological changes in interface condition by the change in natural frequency, although no one modal parameter could uniquely distinguish between each interface condition. The importance of the model boundary condition (how the model is constrained) was the key finding; variations in the boundary condition altered the modal parameters obtained. Therefore the boundary conditions need to be held constant between tests in order for the detected modal parameter changes to be attributed to interface condition changes. A three dimensional Finite Element (FE) model of the femur-implant model was then developed and used to explore the sensitivity of the modal parameters to more subtle interfacial and boundary condition changes. The FE model was created using the synthetic femur geometry and an approximation of the implant geometry. The natural frequencies of the FE model were found to match the experimental frequencies within 20% and the FE and experimental mode shapes were similar. Therefore the FE model was shown to successfully capture the dynamic response of the physical system. As was found with the experimental modal analysis, the fundamental bending mode of the FE model did not alter due to changes in interface elastic modulus. Axial and torsional modes were identified by the FE model that were not detected experimentally; the torsional mode exhibited the largest frequency change due to interfacial changes (103% between the lower and upper limits of the interface modulus range). Therefore the FE model provided additional information on the dynamic response of the system and was complementary to the experimental model. The small changes in natural frequency over a large range of interface region elastic moduli indicated the method may only be able to distinguish between early and late OI progression. The boundary conditions applied to the FE model influenced the modal parameters to a far greater extent than the interface condition variations. Therefore the FE model, as well as the experimental modal analysis, indicated that the boundary conditions need to be held constant between tests in order for the detected changes in modal parameters to be attributed to interface condition changes alone. The results of this study suggest that in a clinical setting it is unlikely that the in vivo boundary conditions of the amputated femur could be adequately controlled or replicated over time and consequently it is unlikely that any longitudinal change in frequency detected by the modal analysis technique could be attributed exclusively to changes at the femur-implant interface. Therefore further development of the modal analysis technique would require significant consideration of the clinical boundary conditions and investigation of modes other than the bending modes.

Is providing micro-credit social responsible?

Micro-finance, which includes micro-credit as one it its services, has become big business with a range of models – from those that operate on a strictly business basis to those who come from a philanthropic base, through Non Government organisations (NGOs). Success is often measured by the numbers involved and the repayment rates – which are very high, largely because of the lending models used. The purpose of this paper is to identify whether the means used to deliver micro-credit services to the poor are socially responsible. This paper will explore the range of models currently used and propose a model that addresses some of the social responsibility issues that appear to plague delivery. The model is being developed in Beira, the second largest city in Mozambique. Mozambique exhibits many of the characteristics found in other African countries, so the model, if successful, may have implications for other poor African nations.

Who's afraid of the dark? Transpower New Zealand Ltd

On 12 June 2006, the lights went out in New Zealand’s largest city and major commercial centre, Auckland. Business was disrupted and many thousands of people inconvenienced. The unscheduled power cut was the latest in a series of electric power problems in New Zealand over the past decade. Attention turned to state-owned enterprise [SOE] Transpower, which was in charge of maintaining and developing New Zealand’s national electricity grid. The problem of 12 June was traced to two shackles in poor condition, small but essential parts of the electricity grid infrastructure. Closer examination of New Zealand’s electricity sector indicated these shackles were merely the tip of a power supply iceberg. Transpower’s Chief Executive, Ralph Craven, was now answerable to the Prime Minister for the issues creating the problems, and a workable solution to fix them. Transpower Chief Executive Ralph Craven needed to produce answers that went well beyond the problem of the two faulty shackles. The power crisis had brought to the fore wider issues of roles, responsibilities, and expectations in relation to the supply of electric power in New Zealand. Transpower was contending with these issues on a daily basis; however, the incident on 12 June publicly highlighted the urgent need for solutions that served the stakeholders in this critical industry.

Introduction : the South Asia Infant Feeding Research Network (SAIFRN)

The South Asia Infant Feeding Research Network (SAIFRN) was established in 2007 to foster and coordinate a research partnership among South Asian and international research groups interested in infant and young child feeding. SAIFRN has brought together a mix of researchers and program managers from Bangladesh, India, Nepal, Pakistan, and Sri Lanka together with international partners from Australia. As the first activity, SAIFRN conducted a series of analyses using Demographic and Health Surveys of Bangladesh, Nepal, and Sri Lanka and the National Family Health Survey of India. The results highlight that most indicators of infant and young child feeding in these four countries have not reached the targeted levels. The rates vary considerably by country, and the factors associated with poor feeding practices were not always consistent across countries. Driven by the ultimate goal of improved child survival in the region, SAIFRN wishes to expand its partnerships with governmental and nongovernmental organizations that share common interests both within and outside the South Asia region. In the future, SAIFRN hopes to provide more opportunities to researchers in the region to improve their skills by participating in capacity-building programs in collaboration with international partner institutions, and looks forward to liaising with potential donors to support such activities.

Linearity within the SMS4 Block Cipher

We present several new observations on the SMS4 block cipher, and discuss their cryptographic significance. The crucial observation is the existence of fixed points and also of simple linear relationships between the bits of the input and output words for each component of the round functions for some input words. This implies that the non-linear function T of SMS4 does not appear random and that the linear transformation provides poor diffusion. Furthermore, the branch number of the linear transformation in the key scheduling algorithm is shown to be less than optimal. The main security implication of these observations is that the round function is not always non-linear. Due to this linearity, it is possible to reduce the number of effective rounds of SMS4 by four. We also investigate the susceptibility of SMS4 to further cryptanalysis. Finally, we demonstrate a successful differential attack on a slightly modified variant of SMS4. These findings raise serious questions on the security provided by SMS4.

Adapting to the work-life interface : the influence of individual differences, work and family on well-being, mental health and work engagement

Bronfenbrenner.s Bioecological Model, expressed as the developmental equation, D f PPCT, is the theoretical framework for two studies that bring together diverse strands of psychology to study the work-life interface of working adults. Occupational and organizational psychology is focused on the demands and resources of work and family, without emphasising the individual in detail. Health and personality psychology examine the individual but without emphasis on the individual.s work and family roles. The current research used Bronfenbrenner.s theoretical framework to combine individual differences, work and family to understand how these factors influence the working adult.s psychological functioning. Competent development has been defined as high well-being (measured as life satisfaction and psychological well-being) and high work engagement (as work vigour, work dedication and absorption in work) and as the absence of mental illness (as depression, anxiety and stress) and the absence of burnout (as emotional exhaustion, cynicism and professional efficacy). Study 1 and 2 were linked, with Study 1 as a cross-sectional survey and Study 2, a prospective panel study that followed on from the data used in Study1. Participants were recruited from a university and from a large public hospital to take part in a 3-wave, online study where they completed identical surveys at 3-4 month intervals (N = 470 at Time 1 and N = 198 at Time 3). In Study 1, hierarchical multiple regressions were used to assess the effects of individual differences (Block 1, e.g. dispositional optimism, coping self-efficacy, perceived control of time, humour), work and family variables (Block 2, e.g. affective commitment, skill discretion, work hours, children, marital status, family demands) and the work-life interface (Block 3, e.g. direction and quality of spillover between roles, work-life balance) on the outcomes. There were a mosaic of predictors of the outcomes with a group of seven that were the most frequent significant predictors and which represented the individual (dispositional optimism and coping self-efficacy), the workplace (skill discretion, affective commitment and job autonomy) and the work-life interface (negative work-to-family spillover and negative family-to-work spillover). Interestingly, gender and working hours were not important predictors. The effects of job social support, generally and for work-life issues, perceived control of time and egalitarian gender roles on the outcomes were mediated by negative work-to-family spillover, particularly for emotional exhaustion. Further, the effect of negative spillover on depression, anxiety and work engagement was moderated by the individual.s personal and workplace resources. Study 2 modelled the longitudinal relationships between the group of the seven most frequent predictors and the outcomes. Using a set of non-nested models, the relative influences of concurrent functioning, stability and change over time were assessed. The modelling began with models at Time 1, which formed the basis for confirmatory factor analysis (CFA) to establish the underlying relationships between the variables and calculate the composite variables for the longitudinal models. The CFAs were well fitting with few modifications to ensure good fit. However, using burnout and work engagement together required additional analyses to resolve poor fit, with one factor (representing a continuum from burnout to work engagement) being the only acceptable solution. Five different longitudinal models were investigated as the Well-Being, Mental Distress, Well-Being-Mental Health, Work Engagement and Integrated models using differing combinations of the outcomes. The best fitting model for each was a reciprocal model that was trimmed of trivial paths. The strongest paths were the synchronous correlations and the paths within variables over time. The reciprocal paths were more variable with weak to mild effects. There was evidence of gain and loss spirals between the variables over time, with a slight net gain in resources that may provide the mechanism for the accumulation of psychological advantage over a lifetime. The longitudinal models also showed that there are leverage points at which personal, psychological and managerial interventions can be targeted to bolster the individual and provide supportive workplace conditions that also minimise negative spillover. Bronfenbrenner.s developmental equation has been a useful framework for the current research, showing the importance of the person as central to the individual.s experience of the work-life interface. By taking control of their own life, the individual can craft a life path that is most suited to their own needs. Competent developmental outcomes were most likely where the person was optimistic and had high self-efficacy, worked in a job that they were attached to and which allowed them to use their talents and without too much negative spillover between their work and family domains. In this way, individuals had greater well-being, better mental health and greater work engagement at any one time and across time.

Behavioral drivers of EIS failure

We argue that the sustained successful operation of an ES is determined by, and is dependent on, multiple organizational stakeholders. The single greatest organizational barrier to EIS success and achieving widespread organizational benefits can be attributed to the way in which different subcultures treat data critical to EIS operation. Building on Lee & Strong’s (2004) data roles we incorporate Schien’s (1996) cultural framework along with DeLone and McLean’s (2003) dimensions of IS success, unpacking the underlying drivers of behaviors as they relate to EIS data. Further, we explain the origins of data based conflict resulting in poor EIS data utilization.

An investigation of the relationship between subjective sleep quality, loneliness and mood in an Australian sample: Can daily routine explain the links?

Background: Loneliness and low mood are associated with significant negative health outcomes including poor sleep, but the strength of the evidence underlying these associations varies. There is strong evidence that poor sleep quality and low mood are linked, but only emerging evidence that loneliness and poor sleep are associated. Aims: To independently replicate the finding that loneliness and poor subjective sleep quality are associated and to extend past research by investigating lifestyle regularity as a possible mediator of relationships, since lifestyle regularity has been linked to loneliness and poor sleep. Methods: Using a cross-sectional design, 97 adults completed standardized measures of loneliness, lifestyle regularity, subjective sleep quality and mood. Results: Loneliness was a significant predictor of sleep quality. Lifestyle regularity was not a predictor of, nor associated with, mood, sleep quality or loneliness. Conclusions: This study provides an important independent replication of the association between poor sleep and loneliness. However, the mechanism underlying this link remains unclear. A theoretically plausible mechanism for this link, lifestyle regularity, does not explain the relationship between loneliness and poor sleep. The nexus between loneliness and poor sleep is unlikely to be broken by altering the social rhythm of patients who present with poor sleep and loneliness.

Clinical outcomes in residential care : setting benchmarks for quality

Aim Australian residential aged care does not have a system of quality assessment related to clinical outcomes, or comprehensive quality benchmarking. The Residential Care Quality Assessment was developed to fill this gap; and this paper discusses the process by which preliminary benchmarks representing high and low quality were developed for it. Methods Data were collected from all residents (n = 498) of nine facilities. Numerator–denominator analysis of clinical outcomes occurred at a facility-level, with rank-ordered results circulated to an expert panel. The panel identified threshold scores to indicate excellent and questionable care quality, and refined these through Delphi process. Results Clinical outcomes varied both within and between facilities; agreed thresholds for excellent and poor outcomes were finalised after three Delphi rounds. Conclusion Use of the Residential Care Quality Assessment provides a concrete means of monitoring care quality and allows benchmarking across facilities; its regular use could contribute to improved care outcomes within residential aged care in Australia.

The hydrodynamic and capture/retention performance of a gross pollutant trap

This research shows that gross pollutant traps (GPTs) continue to play an important role in preventing visible street waste—gross pollutants—from contaminating the environment. The demand for these GPTs calls for stringent quality control and this research provides a foundation to rigorously examine the devices. A novel and comprehensive testing approach to examine a dry sump GPT was developed. The GPT is designed with internal screens to capture gross pollutants—organic matter and anthropogenic litter. This device has not been previously investigated. Apart from the review of GPTs and gross pollutant data, the testing approach includes four additional aspects to this research, which are: field work and an historical overview of street waste/stormwater pollution, calibration of equipment, hydrodynamic studies and gross pollutant capture/retention investigations. This work is the first comprehensive investigation of its kind and provides valuable practical information for the current research and any future work pertaining to the operations of GPTs and management of street waste in the urban environment. Gross pollutant traps—including patented and registered designs developed by industry—have specific internal configurations and hydrodynamic separation characteristics which demand individual testing and performance assessments. Stormwater devices are usually evaluated by environmental protection agencies (EPAs), professional bodies and water research centres. In the USA, the American Society of Civil Engineers (ASCE) and the Environmental Water Resource Institute (EWRI) are examples of professional and research organisations actively involved in these evaluation/verification programs. These programs largely rely on field evaluations alone that are limited in scope, mainly for cost and logistical reasons. In Australia, evaluation/verification programs of new devices in the stormwater industry are not well established. The current limitations in the evaluation methodologies of GPTs have been addressed in this research by establishing a new testing approach. This approach uses a combination of physical and theoretical models to examine in detail the hydrodynamic and capture/retention characteristics of the GPT. The physical model consisted of a 50% scale model GPT rig with screen blockages varying from 0 to 100%. This rig was placed in a 20 m flume and various inlet and outflow operating conditions were modelled on observations made during the field monitoring of GPTs. Due to infrequent cleaning, the retaining screens inside the GPTs were often observed to be blocked with organic matter. Blocked screens can radically change the hydrodynamic and gross pollutant capture/retention characteristics of a GPT as shown from this research. This research involved the use of equipment, such as acoustic Doppler velocimeters (ADVs) and dye concentration (Komori) probes, which were deployed for the first time in a dry sump GPT. Hence, it was necessary to rigorously evaluate the capability and performance of these devices, particularly in the case of the custom made Komori probes, about which little was known. The evaluation revealed that the Komori probes have a frequency response of up to 100 Hz —which is dependent upon fluid velocities—and this was adequate to measure the relevant fluctuations of dye introduced into the GPT flow domain. The outcome of this evaluation resulted in establishing methodologies for the hydrodynamic measurements and gross pollutant capture/retention experiments. The hydrodynamic measurements consisted of point-based acoustic Doppler velocimeter (ADV) measurements, flow field particle image velocimetry (PIV) capture, head loss experiments and computational fluid dynamics (CFD) simulation. The gross pollutant capture/retention experiments included the use of anthropogenic litter components, tracer dye and custom modified artificial gross pollutants. Anthropogenic litter was limited to tin cans, bottle caps and plastic bags, while the artificial pollutants consisted of 40 mm spheres with a range of four buoyancies. The hydrodynamic results led to the definition of global and local flow features. The gross pollutant capture/retention results showed that when the internal retaining screens are fully blocked, the capture/retention performance of the GPT rapidly deteriorates. The overall results showed that the GPT will operate efficiently until at least 70% of the screens are blocked, particularly at high flow rates. This important finding indicates that cleaning operations could be more effectively planned when the GPT capture/retention performance deteriorates. At lower flow rates, the capture/retention performance trends were reversed. There is little difference in the poor capture/retention performance between a fully blocked GPT and a partially filled or empty GPT with 100% screen blockages. The results also revealed that the GPT is designed with an efficient high flow bypass system to avoid upstream blockages. The capture/retention performance of the GPT at medium to high inlet flow rates is close to maximum efficiency (100%). With regard to the design appraisal of the GPT, a raised inlet offers a better capture/retention performance, particularly at lower flow rates. Further design appraisals of the GPT are recommended.

Strengthening and formally verifying privacy in identity management systems

In a digital world, users’ Personally Identifiable Information (PII) is normally managed with a system called an Identity Management System (IMS). There are many types of IMSs. There are situations when two or more IMSs need to communicate with each other (such as when a service provider needs to obtain some identity information about a user from a trusted identity provider). There could be interoperability issues when communicating parties use different types of IMS. To facilitate interoperability between different IMSs, an Identity Meta System (IMetS) is normally used. An IMetS can, at least theoretically, join various types of IMSs to make them interoperable and give users the illusion that they are interacting with just one IMS. However, due to the complexity of an IMS, attempting to join various types of IMSs is a technically challenging task, let alone assessing how well an IMetS manages to integrate these IMSs. The first contribution of this thesis is the development of a generic IMS model called the Layered Identity Infrastructure Model (LIIM). Using this model, we develop a set of properties that an ideal IMetS should provide. This idealized form is then used as a benchmark to evaluate existing IMetSs. Different types of IMS provide varying levels of privacy protection support. Unfortunately, as observed by Jøsang et al (2007), there is insufficient privacy protection in many of the existing IMSs. In this thesis, we study and extend a type of privacy enhancing technology known as an Anonymous Credential System (ACS). In particular, we extend the ACS which is built on the cryptographic primitives proposed by Camenisch, Lysyanskaya, and Shoup. We call this system the Camenisch, Lysyanskaya, Shoup - Anonymous Credential System (CLS-ACS). The goal of CLS-ACS is to let users be as anonymous as possible. Unfortunately, CLS-ACS has problems, including (1) the concentration of power to a single entity - known as the Anonymity Revocation Manager (ARM) - who, if malicious, can trivially reveal a user’s PII (resulting in an illegal revocation of the user’s anonymity), and (2) poor performance due to the resource-intensive cryptographic operations required. The second and third contributions of this thesis are the proposal of two protocols that reduce the trust dependencies on the ARM during users’ anonymity revocation. Both protocols distribute trust from the ARM to a set of n referees (n > 1), resulting in a significant reduction of the probability of an anonymity revocation being performed illegally. The first protocol, called the User Centric Anonymity Revocation Protocol (UCARP), allows a user’s anonymity to be revoked in a user-centric manner (that is, the user is aware that his/her anonymity is about to be revoked). The second protocol, called the Anonymity Revocation Protocol with Re-encryption (ARPR), allows a user’s anonymity to be revoked by a service provider in an accountable manner (that is, there is a clear mechanism to determine which entity who can eventually learn - and possibly misuse - the identity of the user). The fourth contribution of this thesis is the proposal of a protocol called the Private Information Escrow bound to Multiple Conditions Protocol (PIEMCP). This protocol is designed to address the performance issue of CLS-ACS by applying the CLS-ACS in a federated single sign-on (FSSO) environment. Our analysis shows that PIEMCP can both reduce the amount of expensive modular exponentiation operations required and lower the risk of illegal revocation of users’ anonymity. Finally, the protocols proposed in this thesis are complex and need to be formally evaluated to ensure that their required security properties are satisfied. In this thesis, we use Coloured Petri nets (CPNs) and its corresponding state space analysis techniques. All of the protocols proposed in this thesis have been formally modeled and verified using these formal techniques. Therefore, the fifth contribution of this thesis is a demonstration of the applicability of CPN and its corresponding analysis techniques in modeling and verifying privacy enhancing protocols. To our knowledge, this is the first time that CPN has been comprehensively applied to model and verify privacy enhancing protocols. From our experience, we also propose several CPN modeling approaches, including complex cryptographic primitives (such as zero-knowledge proof protocol) modeling, attack parameterization, and others. The proposed approaches can be applied to other security protocols, not just privacy enhancing protocols.