Diseño y desarrollo de una solución de resistant communications al protocolo Host Identity Protocol

[ES]Este Trabajo de Fin de Grado consiste en diseñar y desarrollar una solución de resilient communications para su uso en entornos de movilidad, en concreto, en entornos vehiculares. Se diseñara una solución que consiste en añadir soporte de múltiples vías de comunicación entre dos extremos para el protocolo de movilidad HIP. Este trabajo consiste en buscar una solución de resilient communications, ya que buscamos como objetivo principal aumentar la disponibilidad del sistema de comunicaciones, es decir, aumentar aspectos tales como la tolerancia a fallos y contra ataques de seguridad, concretamente contra ataques contra la disponibilidad.

Protocol engineering for protection against denial-of-service attacks

Denial-of-service attacks (DoS) and distributed denial-of-service attacks (DDoS) attempt to temporarily disrupt users or computer resources to cause service un- availability to legitimate users in the internetworking system. The most common type of DoS attack occurs when adversaries °ood a large amount of bogus data to interfere or disrupt the service on the server. The attack can be either a single-source attack, which originates at only one host, or a multi-source attack, in which multiple hosts coordinate to °ood a large number of packets to the server. Cryptographic mechanisms in authentication schemes are an example ap- proach to help the server to validate malicious tra±c. Since authentication in key establishment protocols requires the veri¯er to spend some resources before successfully detecting the bogus messages, adversaries might be able to exploit this °aw to mount an attack to overwhelm the server resources. The attacker is able to perform this kind of attack because many key establishment protocols incorporate strong authentication at the beginning phase before they can iden- tify the attacks. This is an example of DoS threats in most key establishment protocols because they have been implemented to support con¯dentiality and data integrity, but do not carefully consider other security objectives, such as availability. The main objective of this research is to design denial-of-service resistant mechanisms in key establishment protocols. In particular, we focus on the design of cryptographic protocols related to key establishment protocols that implement client puzzles to protect the server against resource exhaustion attacks. Another objective is to extend formal analysis techniques to include DoS- resistance. Basically, the formal analysis approach is used not only to analyse and verify the security of a cryptographic scheme carefully but also to help in the design stage of new protocols with a high level of security guarantee. In this research, we focus on an analysis technique of Meadows' cost-based framework, and we implement DoS-resistant model using Coloured Petri Nets. Meadows' cost-based framework is directly proposed to assess denial-of-service vulnerabil- ities in the cryptographic protocols using mathematical proof, while Coloured Petri Nets is used to model and verify the communication protocols using inter- active simulations. In addition, Coloured Petri Nets are able to help the protocol designer to clarify and reduce some inconsistency of the protocol speci¯cation. Therefore, the second objective of this research is to explore vulnerabilities in existing DoS-resistant protocols, as well as extend a formal analysis approach to our new framework for improving DoS-resistance and evaluating the performance of the new proposed mechanism. In summary, the speci¯c outcomes of this research include following results; 1. A taxonomy of denial-of-service resistant strategies and techniques used in key establishment protocols; 2. A critical analysis of existing DoS-resistant key exchange and key estab- lishment protocols; 3. An implementation of Meadows's cost-based framework using Coloured Petri Nets for modelling and evaluating DoS-resistant protocols; and 4. A development of new e±cient and practical DoS-resistant mechanisms to improve the resistance to denial-of-service attacks in key establishment protocols.

Analytical efficiency evaluation of a network mobility management protocol for Intelligent Transportation Systems

One of the major concerns in an Intelligent Transportation System (ITS) scenario, such as that which may be found on a long-distance train service, is the provision of efficient communication services, satisfying users' expectations, and fulfilling even highly demanding application requirements, such as safety-oriented services. In an ITS scenario, it is common to have a significant amount of onboard devices that comprise a cluster of nodes (a mobile network) that demand connectivity to the outside networks. This demand has to be satisfied without service disruption. Consequently, the mobility of the mobile network has to be managed. Due to the nature of mobile networks, efficient and lightweight protocols are desired in the ITS context to ensure adequate service performance. However, the security is also a key factor in this scenario. Since the management of the mobility is essential for providing communications, the protocol for managing this mobility has to be protected. Furthermore, there are safety-oriented services in this scenario, so user application data should also be protected. Nevertheless, providing security is expensive in terms of efficiency. Based on this considerations, we have developed a solution for managing the network mobility for ITS scenarios: the NeMHIP protocol. This approach provides a secure management of network mobility in an efficient manner. In this article, we present this protocol and the strategy developed to maintain its security and efficiency in satisfactory levels. We also present the developed analytical models to analyze quantitatively the efficiency of the protocol. More specifically, we have developed models for assessing it in terms of signaling cost, which demonstrates that NeMHIP generates up to 73.47% less signaling compared to other relevant approaches. Therefore, the results obtained demonstrate that NeMHIP is the most efficient and secure solution for providing communications in mobile network scenarios such as in an ITS context.

Using coloured petri nets to simulate DoS-resistant protocols

In this work, we examine unbalanced computation between an initiator and a responder that leads to resource exhaustion attacks in key exchange protocols. We construct models for two cryp-tographic protocols; one is the well-known Internet protocol named Secure Socket Layer (SSL) protocol, and the other one is the Host Identity Protocol (HIP) which has built-in DoS-resistant mechanisms. To examine such protocols, we develop a formal framework based on Timed Coloured Petri Nets (Timed CPNs) and use a simulation approach provided in CPN Tools to achieve a formal analysis. By adopting the key idea of Meadows' cost-based framework and re¯ning the de¯nition of operational costs during the protocol execution, our simulation provides an accurate cost estimate of protocol execution compar- ing among principals, as well as the percentage of successful connections from legitimate users, under four di®erent strategies of DoS attack.

Análisis de rendimiento de técnicas criptográficas en el protocolo de movilidad HIP

[ES]Este proyecto tiene como objetivo analizar el rendimiento de diferentes técnicas criptográficas que el protocolo de movilidad HIP puede utilizar para proporcionar los servicios de seguridad que se determinen. Lo primero que se hará será seleccionar los diferentes algoritmos criptográficos que HIP podría utilizar para cubrir los servicios de seguridad considerados más relevantes, estos son autenticación, confidencialidad e integridad de datos. A continuación se identificarán los parámetros más significativos en relación al rendimiento y se definirá un escenario y un plan de pruebas para realizar las mediciones. Posteriormente se realizarán las mediciones con los algoritmos criptográficos previamente seleccionados, y por último se analizarán y valorarán los resultados obtenidos para así determinar la eficiencia de cada algoritmo criptográfico.

Avaliação da funcionalidade de atletas de basquete sobre rodas com lesão medular na perspectiva da Classificação Internacional de Funcionalidade, Incapacidade e Saúde (CIF)

Introduction: Spinal cord injury occurs due to interuption in nerve stimuli and could caused from traumatic and non-traumatic illnes. After spinal cord, there are problems in personal life activities affecting ou modifying personal life and provoking impacts in his own life. International Classification of Functioning, Disability and Healthy (ICF) consider and analyse more than the illness ou injury and include informations about functionality in differents domains as activities, participation and enviroment. Objective: The aim of this study is to evaluate functionality wheelchair athlets with spinal cord injury using ICF. Metodology: For this research, it was evaluated 60 athlets with spinal cord injury who were practicing wheelchair basqketball, using the Checklist corresponding to the main ICF categories and othes Identity Protocol with personal datas, lesion time, lesion level and functional classification from bwheelchair basketball. Results: In analyses, we identify in quartis data, that in Body Fucntion, median was 56,67% from all athlets with light and moderate qualifications; In Body Strutucture, the median was 60% for light qualifications; in Activities and Participation, this median corresponded to 91% and in Enviroment Factors, 51,67% feel that this enviroment was facilitator... (Complete abstract click electronic access below)

REFLEXOS INDIVIDUAIS DO USO PESSOAL E EXCESSIVO DE COMUNICADORES INSTANTÂNEOS NO AMBIENTE DE TRABALHO

A Internet está inserida no cotidiano do indivíduo, e torna-se cada vez mais acessível por meio de diferentes tipos de dispositivos. Com isto, diversos estudos foram realizados com o intuito de avaliar os reflexos do seu uso excessivo na vida pessoal, acadêmica e profissional. Esta dissertação buscou identificar se a perda de concentração e o isolamento social são alguns dos reflexos individuais que o uso pessoal e excessivo de aplicativos de comunicação instantânea podem resultar no ambiente de trabalho. Entre as variáveis selecionadas para avaliar os aspectos do uso excessivo de comunicadores instantâneos tem-se a distração digital, o controle reduzido de impulso, o conforto social e a solidão. Através de uma abordagem de investigação quantitativa, utilizaram-se escalas aplicadas a uma amostra de 283 pessoas. Os dados foram analisados por meio de técnicas estatísticas multivariadas como a Análise Fatorial Exploratória e para auferir a relação entre as variáveis, a Regressão Linear Múltipla. Os resultados deste estudo confirmam que o uso excessivo de comunicadores instantâneos está positivamente relacionado com a perda de concentração, e a variável distração digital exerce uma influência maior do que o controle reduzido de impulso. De acordo com os resultados, não se podem afirmar que a solidão e o conforto social exercem relações com aumento do isolamento social, devido à ausência do relacionamento entre os construtos.

A simulation study of a localised computer network

An investigation is carried out into the design of a small local computer network for eventual implementation on the University of Aston campus. Microprocessors are investigated as a possible choice for use as a node controller for reasons of cost and reliability. Since the network will be local, high speed lines of megabit order are proposed. After an introduction to several well known networks, various aspects of networks are discussed including packet switching, functions of a node and host-node protocol. Chapter three develops the network philosophy with an introduction to microprocessors. Various organisations of microprocessors into multicomputer and multiprocessor systems are discussed, together with methods of achieving reliabls computing. Chapter four presents the simulation model and its implentation as a computer program. The major modelling effort is to study the behaviour of messages queueing for access to the network and the message delay experienced on the network. Use is made of spectral analysis to determine the sampling frequency while Sxponentially Weighted Noving Averages are used for data smoothing.

The HUman MicroNucleus project on eXfoLiated buccal cells (HUMNXL): The role of life-style, host factors, occupational exposures, health status, and assay protocol

The human buccal micronucleus cytome assay (BMCyt) is one of the most widely used techniques to measure genetic damage in human population studies. Reducing protocol variability, assessing the role of confounders, and estimating a range of reference values are research priorities that will be addressed by the HUMNXL, collaborative study. The HUMNXL, project evaluates the impact of host factors, occupation, life-style, disease status, and protocol features on the occurrence of MN in exfoliated buccal cells. In addition, the study will provide a range of reference values for all cytome endpoints. A database of 5424 subjects with buccal MN values obtained from 30 laboratories worldwide was compiled and analyzed to investigate the influence of several conditions affecting MN frequency. Random effects models were mostly used to investigate MN predictors. The estimated spontaneous MN frequency was 0.74 parts per thousand (95% CI 0.52-1.05). Only staining among technical features influenced MN frequency, with an abnormal increase for non-DNA-specific stains. No effect of gender was evident, while the trend for age was highly significant (p < 0.001). Most occupational exposures and a diagnosis of cancer significantly increased MN and other endpoints frequencies. MN frequency increased in heavy smoking (>= 40 cig/day. FR = 1.37:95% CI 1.03-.82) and decreased with daily fruit consumption (FR = 0.68; 95% CI 0.50-0.91). The results of the HUMNXL, project identified priorities for validation studies, increased the basic knowledge of the assay, and contributed to the creation of a laboratory network which in perspective may allow the evaluation of disease risk associated with MN frequency. (C) 2011 Elsevier B.V. All rights reserved.

Destination brand equity among the host community : a potential source of comparative advantage for DMO's

Since the emergence of the destination branding literature in 1998, there have been few studies related to performance measurement of destination brand campaigns. There has also been little interest to date in researching the extent to which a destination brand represents the host community’s sense of place. Given that local residents represent a key stakeholder group for the destination marketing organisation (DMO), research is required to examine the extent to which marketing communications have been effective in enhancing engagement with the brand, and inducing a brand image that is congruent with the brand identity. Motivated by conceptual and practical aims, this paper reports the trial of a hierarchy of consumer-based brand equity (CBBE) for a destination, from the perspective of residents as active participants of local tourism. It is proposed that strong levels of CBBE among the host community representsa strong level of CBBE among the host community represents a source of comparative advantage for a destination, for which the DMO could proactively develop into a competitive advantage.

TCP-DR an effective protocol for infrastructure based wireless networks

TCP is a dominant protocol for consistent communication over the internet. It provides flow, congestion and error control mechanisms while using wired reliable networks. Its congestion control mechanism is not suitable for wireless links where data corruption and its lost rate are higher. The physical links are transparent from TCP that takes packet losses due to congestion only and initiates congestion handling mechanisms by reducing transmission speed. This results in wasting already limited available bandwidth on the wireless links. Therefore, there is no use to carry out research on increasing bandwidth of the wireless links until the available bandwidth is not optimally utilized. This paper proposed a hybrid scheme called TCP Detection and Recovery (TCP-DR) to distinguish congestion, corruption and mobility related losses and then instructs the data sending host to take appropriate action. Therefore, the link utilization is optimal while losses are either due to high bit error rate or mobility.

Strengthening and formally verifying privacy in identity management systems

In a digital world, users’ Personally Identifiable Information (PII) is normally managed with a system called an Identity Management System (IMS). There are many types of IMSs. There are situations when two or more IMSs need to communicate with each other (such as when a service provider needs to obtain some identity information about a user from a trusted identity provider). There could be interoperability issues when communicating parties use different types of IMS. To facilitate interoperability between different IMSs, an Identity Meta System (IMetS) is normally used. An IMetS can, at least theoretically, join various types of IMSs to make them interoperable and give users the illusion that they are interacting with just one IMS. However, due to the complexity of an IMS, attempting to join various types of IMSs is a technically challenging task, let alone assessing how well an IMetS manages to integrate these IMSs. The first contribution of this thesis is the development of a generic IMS model called the Layered Identity Infrastructure Model (LIIM). Using this model, we develop a set of properties that an ideal IMetS should provide. This idealized form is then used as a benchmark to evaluate existing IMetSs. Different types of IMS provide varying levels of privacy protection support. Unfortunately, as observed by Jøsang et al (2007), there is insufficient privacy protection in many of the existing IMSs. In this thesis, we study and extend a type of privacy enhancing technology known as an Anonymous Credential System (ACS). In particular, we extend the ACS which is built on the cryptographic primitives proposed by Camenisch, Lysyanskaya, and Shoup. We call this system the Camenisch, Lysyanskaya, Shoup - Anonymous Credential System (CLS-ACS). The goal of CLS-ACS is to let users be as anonymous as possible. Unfortunately, CLS-ACS has problems, including (1) the concentration of power to a single entity - known as the Anonymity Revocation Manager (ARM) - who, if malicious, can trivially reveal a user’s PII (resulting in an illegal revocation of the user’s anonymity), and (2) poor performance due to the resource-intensive cryptographic operations required. The second and third contributions of this thesis are the proposal of two protocols that reduce the trust dependencies on the ARM during users’ anonymity revocation. Both protocols distribute trust from the ARM to a set of n referees (n > 1), resulting in a significant reduction of the probability of an anonymity revocation being performed illegally. The first protocol, called the User Centric Anonymity Revocation Protocol (UCARP), allows a user’s anonymity to be revoked in a user-centric manner (that is, the user is aware that his/her anonymity is about to be revoked). The second protocol, called the Anonymity Revocation Protocol with Re-encryption (ARPR), allows a user’s anonymity to be revoked by a service provider in an accountable manner (that is, there is a clear mechanism to determine which entity who can eventually learn - and possibly misuse - the identity of the user). The fourth contribution of this thesis is the proposal of a protocol called the Private Information Escrow bound to Multiple Conditions Protocol (PIEMCP). This protocol is designed to address the performance issue of CLS-ACS by applying the CLS-ACS in a federated single sign-on (FSSO) environment. Our analysis shows that PIEMCP can both reduce the amount of expensive modular exponentiation operations required and lower the risk of illegal revocation of users’ anonymity. Finally, the protocols proposed in this thesis are complex and need to be formally evaluated to ensure that their required security properties are satisfied. In this thesis, we use Coloured Petri nets (CPNs) and its corresponding state space analysis techniques. All of the protocols proposed in this thesis have been formally modeled and verified using these formal techniques. Therefore, the fifth contribution of this thesis is a demonstration of the applicability of CPN and its corresponding analysis techniques in modeling and verifying privacy enhancing protocols. To our knowledge, this is the first time that CPN has been comprehensively applied to model and verify privacy enhancing protocols. From our experience, we also propose several CPN modeling approaches, including complex cryptographic primitives (such as zero-knowledge proof protocol) modeling, attack parameterization, and others. The proposed approaches can be applied to other security protocols, not just privacy enhancing protocols.

Viruses of banana in East Africa

Bananas are one of the world's most important food crops, providing sustenance and income for millions of people in developing countries and supporting large export industries. Viruses are considered major constraints to banana production, germplasm multiplication and exchange, and to genetic improvement of banana through traditional breeding. In Africa, the two most important virus diseases are bunchy top, caused by Banana bunchy top virus (BBTV), and banana streak disease, caused by Banana streak virus (BSV). BBTV is a serious production constraint in a number of countries within/bordering East Africa, such as Burundi, Democratic Republic of Congo, Malawi, Mozambique, Rwanda and Zambia, but is not present in Kenya, Tanzania and Uganda. Additionally, epidemics of banana streak disease are occurring in Kenya and Uganda. The rapidly growing tissue culture (TC) industry within East Africa, aiming to provide planting material to banana farmers, has stimulated discussion about the need for virus indexing to certify planting material as virus-free. Diagnostic methods for BBTV and BSV have been reported and, for BBTV, PCR-based assays are reliable and relatively straightforward. However for BSV, high levels of serological and genetic variability and the presence of endogenous virus sequences within the banana genome complicate diagnosis. Uganda has been shown to contain the greatest diversity in BSV isolates found anywhere in the world. A broad-spectrum diagnostic test for BSV detection, which can discriminate between endogenous and episomal BSV sequences, is a priority. This PhD project aimed to establish diagnostic methods for banana viruses, with a particular focus on the development of novel methods for BSV detection, and to use these diagnostic methods for the detection and characterisation of banana viruses in East Africa. A novel rolling-circle amplification (RCA) method was developed for the detection of BSV. Using samples of Banana streak MY virus (BSMYV) and Banana streak OL virus (BSOLV) from Australia, this method was shown to distinguish between endogenous and episomal BSV sequences in banana plants. The RCA assay was used to screen a collection of 56 banana samples from south-west Uganda for BSV. RCA detected at least five distinct BSV isolates in these samples, including BSOLV and Banana streak GF virus (BSGFV) as well as three BSV isolates (Banana streak Uganda-I, -L and -M virus) for which only partial sequences had been previously reported. These latter three BSV had only been detected using immuno-capture (IC)-PCR and thus were possible endogenous sequences. In addition to its ability to detect BSV, the RCA protocol was also demonstrated to detect other viruses within the family Caulimoviridae, including Sugar cane bacilliform virus, and Cauliflower mosaic virus. Using the novel RCA method, three distinct BSV isolates from both Kenya and Uganda were identified and characterised. The complete genome of these isolates was sequenced and annotated. All six isolates were shown to have a characteristic badnavirus genome organisation with three open reading frames (ORFs) and the large polyprotein encoded by ORF 3 was shown to contain conserved amino acid motifs for movement, aspartic protease, reverse transcriptase and ribonuclease H activities. As well, several sequences important for expression and replication of the virus genome were identified including the conserved tRNAmet primer binding site present in the intergenic region of all badnaviruses. Based on the International Committee on Taxonomy of Viruses (ICTV) guidelines for species demarcation in the genus Badnavirus, these six isolates were proposed as distinct species, and named Banana streak UA virus (BSUAV), Banana streak UI virus (BSUIV), Banana streak UL virus (BSULV), Banana streak UM virus (BSUMV), Banana streak CA virus (BSCAV) and Banana streak IM virus (BSIMV). Using PCR with species-specific primers designed to each isolate, a genotypically diverse collection of 12 virus-free banana cultivars were tested for the presence of endogenous sequences. For five of the BSV no amplification was observed in any cultivar tested, while for BSIMV, four positive samples were identified in cultivars with a B-genome component. During field visits to Kenya, Tanzania and Uganda, 143 samples were collected and assayed for BSV. PCR using nine sets of species-specific primers, and RCA, were compared for BSV detection. For five BSV species with no known endogenous counterpart (namely BSCAV, BSUAV, BSUIV, BSULV and BSUMV), PCR was used to detect 30 infections from the 143 samples. Using RCA, 96.4% of these samples were considered positive, with one additional sample detected using RCA which was not positive using PCR. For these five BSV, PCR and RCA were both useful for identifying infected samples, irrespective of the host cultivar genotype (Musa A- or B-genome components). For four additional BSV with known endogenous counterparts in the M. balbisiana genome (BSOLV, BSGFV, BSMYV and BSIMV), PCR was shown to detect 75 infections from the 143 samples. In 30 samples from cultivars with an A-only genome component there was 96.3% agreement between PCR positive samples and detection using RCA, again demonstrating either PCR or RCA are suitable methods for detection. However, in 45 samples from cultivars with some B-genome component, the level of agreement between PCR positive samples and RCA positive samples was 70.5%. This suggests that, in cultivars with some B-genome component, many infections were detected using PCR which were the result of amplification of endogenous sequences. In these latter cases, RCA or another method which discriminates between endogenous and episomal sequences, such as immuno-capture PCR, is needed to diagnose episomal BSV infection. Field visits were made to Malawi and Rwanda to collect local isolates of BBTV for validation of a PCR-based diagnostic assay. The presence of BBTV in samples of bananas with bunchy top disease was confirmed in 28 out of 39 samples from Malawi and all nine samples collected in Rwanda, using PCR and RCA. For three isolates, one from Malawi and two from Rwanda, the complete nucleotide sequences were determined and shown to have a similar genome organisation to previously published BBTV isolates. The two isolates from Rwanda had at least 98.1% nucleotide sequence identity between each of the six DNA components, while the similarity between isolates from Rwanda and Malawi was between 96.2% and 99.4% depending on the DNA component. At the amino acid level, similarities in the putative proteins encoded by DNA-R, -S, -M, - C and -N were found to range between 98.8% to 100%. In a phylogenetic analysis, the three East African isolates clustered together within the South Pacific subgroup of BBTV isolates. Nucleotide sequence comparison to isolates of BBTV from outside Africa identified India as the possible origin of East African isolates of BBTV.