Danny De Cock

On the Security of Today's Online Electronic Banking Systems

Current technology is evolving fast and is constantly bringing new dimensions to our daily life. Electronic banking systems provide us with easy access to banking services. The interaction between user and bank has been substantially improved by deploying ATMs, phone banking, Internet banking, and more recently, mobile banking. This paper discusses the security of todays electronic banking systems. We focus on Internet and mobile banking and present an overview and evaluation of the techniques that are used in the current systems. The best practice is indicated, together with improvements for the future. The issues discussed in this paper are generally applicable in other electronic services such as E-commerce and E-government.

Towards a framework for evaluating certificate status information mechanisms

A wide spectrum of certificate revocation mechanisms is currently in use. A number of them have been proposed by standardisation bodies, while some others have originated from academic or private institutions. What is still missing is a systematic and robust framework for the sound evaluation of these mechanisms. We present a mechanism-neutral framework for the evaluation of certificate status information (CSI) mechanisms. These mechanisms collect, process and distribute CSI. A detailed demonstration of its exploitation is also provided. The demonstration is mainly based on the evaluation of Certificate Revocation Lists, as well as of the Online Certificate Status Protocol. Other well-known CSI mechanisms are also mentioned for completeness.

Threat Modelling for Security Tokens in Web Applications

In the last couple of years, several European countries have started projects which intend to provide their citizens with electronic identity cards, driven by the European Directive on Electronic Signatures. One can expect that within a few years, these smart cards will be used in a wide variety of applications. In this paper, we describe the common threats that can be identified when using security tokens such as smart cards in web applications. We illustrate each of these threats with a few attack scenarios. This paper is part of a series of papers, written by several academic teams. Each paper focuses on one particular technological building block for web applications.

Towards a cross‐context identity management framework in e‐health

Purpose – Modern e‐health systems incorporate different healthcare providers in one system and provide an electronic platform to share medical information efficiently. In cross‐context communications between healthcare providers, the same information can be interpreted as different types or values, so that one patient will be issued different identifiers by different healthcare providers. This paper aims to provide a solution to ensure interoperability so that multiple healthcare providers will be able to collaborate in one e‐health system.Design/methodology/approach – This paper primarily focuses on how different healthcare providers, instead of the patients, are able to interact and share information on a common e‐health platform.Findings – In the course of the work, it was found that previous e‐health solutions mainly have a limited view of patient information, where a user‐centric approach for identity management is usually restricted to a single healthcare provider. Interoperability in an e‐health sy...

Introduction to the Belgian EID Card

This article gives a brief introduction to the Belgian EID card project commonly referred to as Belpic. This introduction includes an overview of the history of the project, details on the visual and cryptographic aspects of the EID cards, a discussion of the different sub-CAs involved, together with the card issuing process.

Improving secure long-term archival of digitally signed documents

Long-term archival of signed documents presents specific challenges that do not need to be considered in short-term storage systems. In this paper we present a Secure Long-Term Archival System (SLTAS) that protects, in a verifiable way, the validity of todays digital signatures in a distant future. Moreover, our protocol is the first proposal that provides a proof of when a signature was created, without the possibility of backdating. We include a description of our scheme and an evaluation of its performance in terms of computing time and storage space. Finally, we discuss how to extend our system to achieve additional security properties. This paper does not focus on the long-term availability of archived information. nor on format migration problems.

Identity in federated electronic healthcare

In electronic healthcare several research and standardization activities are emerging that promote federation. In this scenario, the medical information present at different healthcare providers, such as hospitals, general practitioners, test laboratories, etc., are shared for an improved quality of experience from the patient perspective. However, sharing of medical data on a large scale exposes the patient to several privacy-related threats, such as massive data aggregation or profiling. Therefore, the selection of a privacy-preserving identification scheme is a primary requirement in federated e-health. This paper presents an identity management infrastructure that minimizes the above-mentioned threats.

Due processing of personal data in eGovernment?: A case study of the Belgian electronic identity card

In this article, the authors are evaluating the current authentication mechanisms for eGovernment employed in Belgium. Particular focus is placed on the Belgian electronic identity card (eID) and the use of national identification numbers. After evaluating the current situation the authors proceed to highlight possible alternative.

Electronic voting in Belgium: past and future

This paper provides an overview of the electronic and paper-based voting systems that are used in Belgium. It compares the advantages and disadvantages of these systems, and presents a selection of voting systems that have been recommended to the federal and regional governments for future elections in Belgium: an improved paper-based voting system with voter-verifiable paper trails, a family of optical scanning systems, a remote/Internet voting system, and a kiosk/intranet voting system.

Secure Meeting Scheduling with agenTA

When people want to schedule a meeting, the agendas of the partici- pants must be compared to flnd a time suitable for all of them. However, at the same time participants want to keep their agendas private. This paper presents a negotiation protocol which tries to solve this contradic- tion. The protocol is implemented in the agenTa system using mobile software agents, hereby alleviating communication overhead and allow- ing disconnected operation.