ZigBee/ZigBee PRO security assessment based on compromised cryptographic keys

Sensor networks have many applications in monitoring and controlling of environmental properties such as sound, acceleration, vibration and temperature. Due to limitedresources in computation capability, memory and energy, they are vulnerable to many kinds of attacks. The ZigBee specification based on the 802.15.4 standard, defines a set of layers specifically suited to sensor networks. These layers support secure messaging using symmetric cryptographic. This paper presents two different ways for grabbing the cryptographic key in ZigBee: remote attack and physical attack. It also surveys and categorizes some additional attacks which can be performed on ZigBee networks: eavesdropping, spoofing, replay and DoS attacks at different layers. From this analysis, it is shown that some vulnerabilities still in the existing security schema in ZigBee technology.

A Security Framework for JXTA-Overlay

En l'actualitat, la maduresa del camp de la investigació P2P empès a través de nous problemes, relacionats amb la seguretat. Per aquesta raó, la seguretat comença a convertir-se en una de les qüestions clau en l'avaluació d'un sistema P2P, i és important proporcionar mecanismes de seguretat per a sistemes P2P. El projecte JXTAOverlay fa un esforç per utilitzar la tecnologia JXTA per proporcionar un conjunt genèric de funcions que poden ser utilitzades pels desenvolupadors per desplegar aplicacions P2P. No obstant això, encara que el seu disseny es va centrar en qüestions com ara l'escalabilitat o el rendiment general, no va tenir en compte la seguretat. Aquest treball proposa un marc de seguretat, adaptat específicament a la idiosincràsia del JXTAOverlay.

JXTA security in mobile constrained devices

JXME is the JXTA protocols implementation formobile devices using J2ME. Two different flavors of JXME have been implemented, each one specific for a particular set of devices, according to their capabilities. The main value of JXME is its simplicity to create peer-to-peer (P2P) applications in limited devices. In addition to assessing JXME functionalities, it is also important to realize the default security level provided. This paper presents a brief analysis of the current state of security in JXME, focusing on the JXME-Proxied version, identifies existing vulnerabilities and proposes further improvements in this field.

Open Source Software : the Intersection of IP and Security in Open Source

The use of open source software continues to grow on a daily basis. Today, enterprise applications contain 40% to 70% open source code and this fact has legal, development, IT security, risk management and compliance organizations focusing their attention on its use, as never before. They increasingly understand that the open source content within an application must be detected. Once uncovered, decisions regarding compliance with intellectual property licensing obligations must be made and known security vulnerabilities must be remediated. It is no longer sufficient from a risk perspective to not address both open source issues.

Multispectral remote sensing for site-specific nitrogen fertilizer management

The objective of this work was to evaluate the use of multispectral remote sensing for site-specific nitrogen fertilizer management. Satellite imagery from the advanced spaceborne thermal emission and reflection radiometer (Aster) was acquired in a 23 ha corn-planted area in Iran. For the collection of field samples, a total of 53 pixels were selected by systematic randomized sampling. The total nitrogen content in corn leaf tissues in these pixels was evaluated. To predict corn canopy nitrogen content, different vegetation indices, such as normalized difference vegetation index (NDVI), soil-adjusted vegetation index (Savi), optimized soil-adjusted vegetation index (Osavi), modified chlorophyll absorption ratio index 2 (MCARI2), and modified triangle vegetation index 2 (MTVI2), were investigated. The supervised classification technique using the spectral angle mapper classifier (SAM) was performed to generate a nitrogen fertilization map. The MTVI2 presented the highest correlation (R²=0.87) and is a good predictor of corn canopy nitrogen content in the V13 stage, at 60 days after cultivating. Aster imagery can be used to predict nitrogen status in corn canopy. Classification results indicate three levels of required nitrogen per pixel: low (0-2.5 kg), medium (2.5-3 kg), and high (3-3.3 kg).

Homing phenotypes of tumor-specific CD8 T cells are predetermined at the tumor site by crosspresenting APCs.

Expression of tissue-specific homing molecules directs antigen-experienced T cells to particular peripheral tissues. In studies using soluble antigens that focused on skin and gut, antigen-presenting cells (APCs) within regional lymphoid tissues were proposed to be responsible for imprinting homing phenotypes. Whether this occurs in other sites and after physiologic antigen processing and presentation is unknown. We define in vivo imprinting of distinct homing phenotypes on monospecific T cells responding to antigens expressed by tumors in intracerebral, subcutaneous, and intraperitoneal sites with efficient brain-tropism of CD8 T cells crossprimed in the cervical lymph nodes (LNs). Multiple imprinting programs could occur simultaneously in the same LN when tumors were present in more than one site. Thus, the identity of the LN is not paramount in determining the homing phenotype; this critical functional parameter is dictated upstream at the site of antigen capture by crosspresenting APCs.

Multi-site -sertifikaatin vaatimukset ympäristöjohtamisjärjestelmän rakentamisessa

Diplomityö muodostuu kahdesta kokonaisuudesta. Työn teoriaosa kertoo mitä ympäristöjohtaminen on, millaisia ovat multi-site -organisaatio ja multi-site -johtamisjärjestelmä sekä mitä vaatimuksia nämä asettavat yritykselle. Työssä esitetään malli, jota käyttämällä kansainvälisten johtamisjärjestelmästandardien mukaan rakennetut laatu-, ympäristö-, terveys- ja turvallisuusjärjestelmät voidaan yhdistää yhdeksi kokonaisuudeksi, multi-site - johtamisjärjestelmäksi. Malli rakentuu kolmesta tasosta, joita ovat paikallinen, maakohtainen ja konsernitaso. Esimerkkien avulla kerrotaan miteneri lähtökohdista voidaan näiden tasojen kautta edetä kohti yhtä johtamiskokonaisuutta. Esille tuodaan myös multi-site -johtamisjärjestelmän käyttöönottoa puoltavat ja vastustavat näkökohdat. Työn konkreettinen osa on johtamisjärjestelmämallin paikallisen tason toteuttaminen. Ympäristöjohtamisjärjestelmän rakentaminen standardin EN ISO 14001:2004 vaatimusten mukaiseksi Kvaerner Power Oy:n Suomen toimipaikoille sekä tämän järjestelmän yhdistäminen sertifioituun EN ISO 9001 -standardin mukaiseen laatujärjestelmään. Työssä kerrotaan miten ympäristöjohtamisjärjestelmä on rakennettu ja miten laatu- ja ympäristöjärjestelmät on liitetty yhdeksi kokonaisuudeksi. Työn tuloksena syntyi malli johtamisjärjestelmien yhdistämisestä sekä sertifioitu ympäristöjohtamisjärjestelmä, jonka yhdistäminen laatujärjestelmään toteutettiin tavoitteiden mukaisesti.

LRCW.NET: A web site with a virtual laboratory for the study of coarse and cooking wares in the Late Antique Mediterranean

This contribution presents the LRCW.net a website with a virtual laboratory intranet devoted to the study of coarse and cooking wares in the late Antique Mediterranean. It is designed as a public website with a virtual laboratory intranet. There, all institutions and researchers interested in the subject can work together towards a specific purpose such as the creation of an on-line ‘encyclopedia’ for these categories of ceramics. The LRCW.net website and the associated virtual laboratory are just a small part of a wider initiative that aims to create an on-line Encyclopedia for Ancient Ceramics in the Mediterranean.

Gender and Security Sector Reform: Gendering Differently?

Recent efforts to implement gender mainstreaming in the field of security sector reform have resulted in an international policy discourse on gender and security sector reform (GSSR). Critics have challenged GSSR for its focus on 'adding women' and its failure to be transformative. This article contests this assessment, demonstrating that GSSR is not only about 'adding women', but also, importantly, about 'gendering men differently' and has important albeit problematic transformative implications. Drawing on poststructuralist and postcolonial feminist theory, I propose a critical reading of GSSR policy discourse in order to analyse its built-in logics, tensions and implications. I argue that this discourse establishes a powerful 'grid of intelligibility' that draws on gendered and racialized dualisms to normalize certain forms of subjectivity while rendering invisible and marginalizing others, and contributing to reproduce certain forms of normativity and hierarchy. Revealing such processes of discursive in/exclusion and marginalized subjectivities can serve as a starting point to challenge and transform GSSR practice and identify sites of contestation.

Transparent and secure remote network storage system using an untrusted server

Työssä kehitettin läpinäkyvä Internet Small Computer Systems Interface-verkkolevyä (iSCSI) käyttävä varmistusjärjestelmä. Verkkolevyn sisältö suojattiin asiakaspään salauskerroksella (dm-crypt). Järjestely mahdollisti sen, että verkkolevylle tallennetut varmuuskopiot pysyivät luottamuksellisina, vaikka levypalvelinta tarjoava taho oli joko epäluotettava tai suorastaan vihamielinen. Järjestelmän hyötykäyttöä varten kehitettiin helppokäyttöinen prototyyppisovellus. Järjestelmän riskit ja haavoittuvuudet käytiin läpi ja analysoitiin. Järjestelmälle tehtiin myös karkea kryptoanalyysi sen teknistenominaisuuksien pohjalta. Suorituskykymittaukset tehtiin sekä salatulle että salaamattomalle iSCSI-liikenteelle. Näistä todettiin, että salauksen vaikutus suorituskykyyn oli häviävän pieni jopa 100 megabittiä sekunnissa siirtävillä verkkonopeuksilla. Lisäksi pohdittiin teknologian muita sovelluskohteita ja tulevia tutkimusalueita.

Security in RFID devices

Aquest projecte inclou una aproximació als conceptes de RFID i targetes contactless centrant-se en l’ampliament usat MIFARE Classic chip. L’objectiu principal es mostrar el seu funcionament i les seves vulnerabilitats, així com alguns exemples pràctics fent una anàlisi de diferents serveis que les utilitzen.