Security metrics for object-oriented class designs

Measuring quality attributes of object-oriented designs (e.g. maintainability and performance) has been covered by a number of studies. However, these studies have not considered security as much as other quality attributes. Also, most security studies focus at the level of individual program statements. This approach makes it hard and expensive to discover and fix vulnerabilities caused by design errors. In this work, we focus on the security design of an object oriented application and define a number of security metrics. These metrics allow designers to discover and fix security vulnerabilities at an early stage, and help compare the security of various alternative designs. In particular, we propose seven security metrics to measure Data Encapsulation (accessibility) and Cohesion (interactions) of a given object-oriented class from the point of view of potential information flow.

Dynamics of transformation and fragmentation of composite liquid nano-particles

Recent research on particle size distributions and particle concentrations near a busy road cannot be explained by the conventional mechanisms for particle evolution of combustion aerosols. Specifically they appear to be inadequate to explain the experimental observations of particle transformation and the evolution of the total number concentration. This resulted in the development of a new mechanism based on their thermal fragmentation, for the evolution of combustion aerosol nano-particles. A complex and comprehensive pattern of evolution of combustion aerosols, involving particle fragmentation, was then proposed and justified. In that model it was suggested that thermal fragmentation occurs in aggregates of primary particles each of which contains a solid graphite/carbon core surrounded by volatile molecules bonded to the core by strong covalent bonds. Due to the presence of strong covalent bonds between the core and the volatile (frill) molecules, such primary composite particles can be regarded as solid, despite the presence of significant (possibly, dominant) volatile component. Fragmentation occurs when weak van der Waals forces between such primary particles are overcome by their thermal (Brownian) motion. In this work, the accepted concept of thermal fragmentation is advanced to determine whether fragmentation is likely in liquid composite nano-particles. It has been demonstrated that at least at some stages of evolution, combustion aerosols contain a large number of composite liquid particles containing presumably several components such as water, oil, volatile compounds, and minerals. It is possible that such composite liquid particles may also experience thermal fragmentation and thus contribute to, for example, the evolution of the total number concentration as a function of distance from the source. Therefore, the aim of this project is to examine theoretically the possibility of thermal fragmentation of composite liquid nano-particles consisting of immiscible liquid v components. The specific focus is on ternary systems which include two immiscible liquid droplets surrounded by another medium (e.g., air). The analysis shows that three different structures are possible, the complete encapsulation of one liquid by the other, partial encapsulation of the two liquids in a composite particle, and the two droplets separated from each other. The probability of thermal fragmentation of two coagulated liquid droplets is discussed and examined for different volumes of the immiscible fluids in a composite liquid particle and their surface and interfacial tensions through the determination of the Gibbs free energy difference between the coagulated and fragmented states, and comparison of this energy difference with the typical thermal energy kT. The analysis reveals that fragmentation was found to be much more likely for a partially encapsulated particle than a completely encapsulated particle. In particular, it was found that thermal fragmentation was much more likely when the volume ratio of the two liquid droplets that constitute the composite particle are very different. Conversely, when the two liquid droplets are of similar volumes, the probability of thermal fragmentation is small. It is also demonstrated that the Gibbs free energy difference between the coagulated and fragmented states is not the only important factor determining the probability of thermal fragmentation of composite liquid particles. The second essential factor is the actual structure of the composite particle. It is shown that the probability of thermal fragmentation is also strongly dependent on the distance that each of the liquid droplets should travel to reach the fragmented state. In particular, if this distance is larger than the mean free path for the considered droplets in the air, the probability of thermal fragmentation should be negligible. In particular, it follows form here that fragmentation of the composite particle in the state with complete encapsulation is highly unlikely because of the larger distance that the two droplets must travel in order to separate. The analysis of composite liquid particles with the interfacial parameters that are expected in combustion aerosols demonstrates that thermal fragmentation of these vi particles may occur, and this mechanism may play a role in the evolution of combustion aerosols. Conditions for thermal fragmentation to play a significant role (for aerosol particles other than those from motor vehicle exhaust) are determined and examined theoretically. Conditions for spontaneous transformation between the states of composite particles with complete and partial encapsulation are also examined, demonstrating the possibility of such transformation in combustion aerosols. Indeed it was shown that for some typical components found in aerosols that transformation could take place on time scales less than 20 s. The analysis showed that factors that influenced surface and interfacial tension played an important role in this transformation process. It is suggested that such transformation may, for example, result in a delayed evaporation of composite particles with significant water component, leading to observable effects in evolution of combustion aerosols (including possible local humidity maximums near a source, such as a busy road). The obtained results will be important for further development and understanding of aerosol physics and technologies, including combustion aerosols and their evolution near a source.

Porous PLGA microspheres effectively loaded with BSA protein by electrospraying combined with phase separation in liquid nitrogen

Polymer microspheres loaded with bioactive particles, biomolecules, proteins, and/or growth factors play important roles in tissue engineering, drug delivery, and cell therapy. The conventional double emulsion method and a new method of electrospraying into liquid nitrogen were used to prepare bovine serum albumin (BAS)-loaded poly(lactic-co-glycolic acid) (PLGA) porous microspheres. The particle size, the surface morphology and the internal porous structure of the microspheres were observed using scanning electron microscopy (SEM). The loading efficiency, the encapsulation efficiency, and the release profile of the BSA-loaded PLGA microspheres were measured and studied. It was shown that the microspheres from double emulsion had smaller particle sizes (3-50 m), a less porous structure, a poor loading efficiency (5.2 %), and a poor encapsulation efficiency (43.5%). However, the microspheres from the electrospraying into liquid nitrogen had larger particle sizes (400-600 m), a highly porous structure, a high loading efficiency (12.2%), and a high encapsulation efficiency (93.8%). Thus the combination of electrospraying with freezing in liquid nitrogen and subsequent freeze drying represented a suitable way to produce polymer microspheres for effective loading and sustained release of proteins.

Attribute-based authenticated key exchange

We introduce the concept of attribute-based authenticated key exchange (AB-AKE) within the framework of ciphertext policy attribute-based systems. A notion of AKE-security for AB-AKE is presented based on the security models for group key exchange protocols and also taking into account the security requirements generally considered in the ciphertext policy attribute-based setting. We also extend the paradigm of hybrid encryption to the ciphertext policy attribute-based encryption schemes. A new primitive called encapsulation policy attribute-based key encapsulation mechanism (EP-AB-KEM) is introduced and a notion of chosen ciphertext security is de�ned for EP-AB-KEMs. We propose an EP-AB-KEM from an existing attribute-based encryption scheme and show that it achieves chosen ciphertext security in the generic group and random oracle models. We present a generic one-round AB-AKE protocol that satis�es our AKE-security notion. The protocol is generically constructed from any EP-AB-KEM that satis�es chosen ciphertext security. Instantiating the generic AB-AKE protocol with our EP-AB-KEM will result in a concrete one-round AB-AKE protocol also secure in the generic group and random oracle models.

Generic one round group key exchange in the standard model

Minimizing complexity of group key exchange (GKE) protocols is an important milestone towards their practical deployment. An interesting approach to achieve this goal is to simplify the design of GKE protocols by using generic building blocks. In this paper we investigate the possibility of founding GKE protocols based on a primitive called multi key encapsulation mechanism (mKEM) and describe advantages and limitations of this approach. In particular, we show how to design a one-round GKE protocol which satisfies the classical requirement of authenticated key exchange (AKE) security, yet without forward secrecy. As a result, we obtain the first one-round GKE protocol secure in the standard model. We also conduct our analysis using recent formal models that take into account both outsider and insider attacks as well as the notion of key compromise impersonation resilience (KCIR). In contrast to previous models we show how to model both outsider and insider KCIR within the definition of mutual authentication. Our analysis additionally implies that the insider security compiler by Katz and Shin from ACM CCS 2005 can be used to achieve more than what is shown in the original work, namely both outsider and insider KCIR.

Efficient certificateless KEM in the standard model

We give a direct construction of a certificateless key encapsulation mechanism (KEM) in the standard model that is more efficient than the generic constructions proposed before by Huang and Wong \cite{DBLP:conf/acisp/HuangW07}. We use a direct construction from Kiltz and Galindo's KEM scheme \cite{DBLP:conf/acisp/KiltzG06} to obtain a certificateless KEM in the standard model; our construction is roughly twice as efficient as the generic construction. We also address the security flaw discovered by Selvi et al. \cite{cryptoeprint:2009:462}.

Certificateless key agreement in the standard model

We show how to construct a certificateless key agreement protocol from the certificateless key encapsulation mechanism introduced by \cite{lippold-ICISC_2009} in ICISC 2009 using the \cite{DBLP:conf/acisp/BoydCNP08} protocol from ACISP 2008. We introduce the Canetti-Krawczyk (CK) model for certificateless cryptography, give security notions for Type I and Type II adversaries in the CK model, and highlight the differences to the existing e$^2$CK model discussed by \cite{DBLP:conf/pairing/LippoldBN09}. The resulting CK model is more relaxed thus giving more power to the adversary than the original CK model.

Design and analysis of group key exchange protocols

A group key exchange (GKE) protocol allows a set of parties to agree upon a common secret session key over a public network. In this thesis, we focus on designing efficient GKE protocols using public key techniques and appropriately revising security models for GKE protocols. For the purpose of modelling and analysing the security of GKE protocols we apply the widely accepted computational complexity approach. The contributions of the thesis to the area of GKE protocols are manifold. We propose the first GKE protocol that requires only one round of communication and is proven secure in the standard model. Our protocol is generically constructed from a key encapsulation mechanism (KEM). We also suggest an efficient KEM from the literature, which satisfies the underlying security notion, to instantiate the generic protocol. We then concentrate on enhancing the security of one-round GKE protocols. A new model of security for forward secure GKE protocols is introduced and a generic one-round GKE protocol with forward security is then presented. The security of this protocol is also proven in the standard model. We also propose an efficient forward secure encryption scheme that can be used to instantiate the generic GKE protocol. Our next contributions are to the security models of GKE protocols. We observe that the analysis of GKE protocols has not been as extensive as that of two-party key exchange protocols. Particularly, the security attribute of key compromise impersonation (KCI) resilience has so far been ignored for GKE protocols. We model the security of GKE protocols addressing KCI attacks by both outsider and insider adversaries. We then show that a few existing protocols are not secure against KCI attacks. A new proof of security for an existing GKE protocol is given under the revised model assuming random oracles. Subsequently, we treat the security of GKE protocols in the universal composability (UC) framework. We present a new UC ideal functionality for GKE protocols capturing the security attribute of contributiveness. An existing protocol with minor revisions is then shown to realize our functionality in the random oracle model. Finally, we explore the possibility of constructing GKE protocols in the attribute-based setting. We introduce the concept of attribute-based group key exchange (AB-GKE). A security model for AB-GKE and a one-round AB-GKE protocol satisfying our security notion are presented. The protocol is generically constructed from a new cryptographic primitive called encapsulation policy attribute-based KEM (EP-AB-KEM), which we introduce in this thesis. We also present a new EP-AB-KEM with a proof of security assuming generic groups and random oracles. The EP-AB-KEM can be used to instantiate our generic AB-GKE protocol.

The influence of fibrin based hydrogels on the chondrogenic differentiation of human bone marrow stromal cells

Mesenchymal Stem Cells (MSC) are frequently incorporated into osteochondral implants and cell seeding is often facilitated with hydrogels which exert a profound influence on the chondrogenic differentiation of MSC. An attempt was made to elucidate this effect by comparing the chondrogenic differentiation of Bone Marrow Stromal Cells (BMSC) in fibrin and fibrin alginate composites. A biphasic osteochondral model which simulated the native in vivo environment was employed in the study. In the first stage of the experiment, BMSC was encapsulated in fibrin, Fibrin Alginate 0.3% (FA0.3) and 0.6% (FA0.6). Chondrogenic differentiation within these cell-hydrogel pellets was compared against that of standard cell pellets under inductive conditions and the matrices which supported chondrogenesis were used in the cartilage phase of biphasic constructs. Neo-cartilage growth was monitored in these cocultures. It was observed that hydrogel encapsulation influenced mesenchymal condensation which preceded chondrogenic differentiation. Early cell agglomeration was observed in fibrin as compared to fibrin alginate composites. These fibrin encapsulated cells differentiated into chondrocytes which secreted aggrecan and collagen II. When the alginate content rose from 0.3 to 0.6%, chondrogenic differentiation declined with a reduction in the expression of collagen II and aggrecan. Fibrin and FA0.3 were tested in the cartilage phase of the biphasic osteochondral constructs and the former supported superior cartilage growth with higher cellularity, total Glycosaminoglycan (GAG) and collagen II levels. The FA0.3 cartilage phase was found to be fragmented and partially calcified. The use of fibrin for cartilage repair was advocated as it facilitated BMSC chondrogenesis and cartilaginous growth in an osteochondral environment.

Bioengineered 3D platform to explore cell-ECM interactions and drug resistance of epithelial ovarian cancer cells

The behaviour of cells cultured within three-dimensional (3D) structures rather than onto two-dimensional (2D) culture plastic more closely reflects their in vivo responses. Consequently, 3D culture systems are becoming crucial scientific tools in cancer cell research. We used a novel 3D culture concept to assess cell-matrix interactions implicated in carcinogenesis: a synthetic hydrogel matrix equipped with key biomimetic features, namely incorporated cell integrin-binding motifs (e.g. RGD peptides) and the ability of being degraded by cell-secreted proteases (e.g. matrix metalloproteases). As a cell model, we chose epithelial ovarian cancer, an aggressive disease typically diagnosed at an advanced stage when chemoresistance occurs. Both cell lines used (OV-MZ-6, SKOV-3) proliferated similarly in 2D, but not in 3D. Spheroid formation was observed exclusively in 3D when cells were embedded within hydrogels. By exploiting the design flexibility of the hydrogel characteristics, we showed that proliferation in 3D was dependent on cell-integrin engagement and the ability of cells to proteolytically remodel their extracellular microenvironment. Higher survival rates after exposure to the anti-cancer drug paclitaxel were observed in cell spheroids grown in hydrogels (40-60%) compared to cell monolayers in 2D (20%). Thus, 2D evaluation of chemosensitivity may not reflect pathophysiological events seen in patients. Because of the design flexibility of their characteristics and their stability in long-term cultures (28 days), these biomimetic hydrogels represent alternative culture systems for the increasing demand in cancer research for more versatile, physiologically relevant and reproducible 3D matrices.

PLGA-based microparticles for the sustained release of BMP-2

The development of growth factor delivery strategies to circumvent the burst release phenomenon prevalent in most current systems has driven research towards encapsulating molecules in resorbable polymer matrices. For these polymer release techniques to be efficacious in a clinical setting, several key points need to be addressed. This present study has investigated the encapsulation of the growth factor, BMP-2 within PLGA/PLGA-PEG-PLGA microparticles. Morphology, size distribution, encapsulation efficiency and release kinetics were investigated and we have demonstrated a sustained release of bioactive BMP-2. Furthermore, biocompatibility of the PLGA microparticles was established and released BMP-2 was shown to promote the differentiation of MC3T3-E1 cells towards the osteogenic lineage to a greater extent than osteogenic supplements (as early as day 10 in culture), as determined using alkaline phosphatase and alizarin red assays. This study showcases a potential BMP-2 delivery system which may now be translated into more complex delivery systems, such as 3D, mechanically robust scaffolds for bone tissue regeneration applications.

A hierarchical security assessment model for object-oriented programs

We present a hierarchical model for assessing an object-oriented program's security. Security is quantified using structural properties of the program code to identify the ways in which `classified' data values may be transferred between objects. The model begins with a set of low-level security metrics based on traditional design characteristics of object-oriented classes, such as data encapsulation, cohesion and coupling. These metrics are then used to characterise higher-level properties concerning the overall readability and writability of classified data throughout the program. In turn, these metrics are then mapped to well-known security design principles such as `assigning the least privilege' and `reducing the size of the attack surface'. Finally, the entire program's security is summarised as a single security index value. These metrics allow different versions of the same program, or different programs intended to perform the same task, to be compared for their relative security at a number of different abstraction levels. The model is validated via an experiment involving five open source Java programs, using a static analysis tool we have developed to automatically extract the security metrics from compiled Java bytecode.

Encryption schemes and key exchange protocols in the certificateless setting

The contributions of this thesis fall into three areas of certificateless cryptography. The first area is encryption, where we propose new constructions for both identity-based and certificateless cryptography. We construct an n-out-of- n group encryption scheme for identity-based cryptography that does not require any special means to generate the keys of the trusted authorities that are participating. We also introduce a new security definition for chosen ciphertext secure multi-key encryption. We prove that our construction is secure as long as at least one authority is uncompromised, and show that the existing constructions for chosen ciphertext security from identity-based encryption also hold in the group encryption case. We then consider certificateless encryption as the special case of 2-out-of-2 group encryption and give constructions for highly efficient certificateless schemes in the standard model. Among these is the first construction of a lattice-based certificateless encryption scheme. Our next contribution is a highly efficient certificateless key encapsulation mechanism (KEM), that we prove secure in the standard model. We introduce a new way of proving the security of certificateless schemes based that are based on identity-based schemes. We leave the identity-based part of the proof intact, and just extend it to cover the part that is introduced by the certificateless scheme. We show that our construction is more efficient than any instanciation of generic constructions for certificateless key encapsulation in the standard model. The third area where the thesis contributes to the advancement of certificateless cryptography is key agreement. Swanson showed that many certificateless key agreement schemes are insecure if considered in a reasonable security model. We propose the first provably secure certificateless key agreement schemes in the strongest model for certificateless key agreement. We extend Swanson's definition for certificateless key agreement and give more power to the adversary. Our new schemes are secure as long as each party has at least one uncompromised secret. Our first construction is in the random oracle model and gives the adversary slightly more capabilities than our second construction in the standard model. Interestingly, our standard model construction is as efficient as the random oracle model construction.

Nitrone [2]rotaxanes: Simultaneous chemical protection and electrochemical activation of a functional group

We report on the use of the hydrogen bond accepting properties of neutral nitrone moieties to prepare benzylic-amide-macrocycle-containing [2]rotaxanes in yields as high as 70 %. X-Ray crystallography shows the presence of up to four intercomponent hydrogen bonds between the amide groups of the macrocycle and the two nitrone groups of the thread. Dynamic 1H NMR studies of the rates of macrocycle pirouetting in nonpolar solutions indicate that amide-nitrone hydrogen bonds are particularly strong, ~1.3 and ~0.2 kcal mol-1 stronger than similar amide-ester and amide-amide interactions, respectively. In addition to polarizing the N-O bond through hydrogen bonding, the rotaxane structure affects the chemistry of the nitrone groups in two significant ways: The intercomponent hydrogen bonding activates the nitrone groups to electrochemical reduction, a one electron reduction of the rotaxane being stablized by a remarkable 400 mV (8.1 kcal mol-1) with respect to the same process in the thread; encapsulation, however, protects the same functional groups from chemical reduction with an external reagent (and slows down electron transfer to and from the electroactive groups in cyclicvoltammetry experiments). Mechanical interlocking with a hydrogen bonding molecular sheath thus provides a route to an encapsulated polarized functional group and radical anions of significant kinetic and thermodynamic stability.