Jaouhar Fattahi

Dynamic context-aware and limited resources-aware service adaptation for pervasive computing

A pervasive computing system (PCS) requires that devices be context aware in order to provide proactively adapted services according to the current context. Because of the highly dynamic environment of a PCS, the service adaptation task must be performed during device operation. Most of the proposed approaches do not deal with the problem in depth, because they are either not really context aware or the problem itself is not thought to be dynamic. Devices in a PCS are generally hand-held, that is, they have limited resources, and so, in the effort to make them more reliable, the service adaptation must take into account this constraint. In this paper, we propose a dynamic service adaptation approach for a device operating in a PCS that is both context aware and limited resources aware. The approach is then modeled using colored Petri Nets and simulated using the CPN Tools, an important step toward its validation.

The Theory of Witness-Functions

Cryptographic protocols are distributed programs that ensure security in all communications. They guarantee agents authentication, data confidentiality, data integrity, atomicity of goods and money, non-repudiation, etc. They are used in all areas: e-commerce, military fields, electronic voting, etc. The use of cryptography is essential to ensure protocols’ security, however, it is not sufficient. Indeed, in the literature, a significant number of cryptographic protocols have long been considered safe, but they were shown faulty many years after their use. Saying that a protocol is correct or not is an undecidable problem in general. However, several methods (logic-based methods, Model-Checking-based methods, typing-based methods, etc.) have emerged to answer this hard question under restrictive assumptions and led to varying results. Here, we present a new formal method to analyze cryptographic protocols statically for the property of secrecy. It consists in inspecting the level of security of every component of exchanged messages in the protocol by new metrics, called witness-functions, and making sure that it does not diminish during its life cycle. If yes, we declare that the protocol keeps its secret inputs. We analyze here an amended version of the Woo-Lam protocol using the witness-functions’ theory.

Secrecy by witness-functions under equational theories

In this paper, we use the witness-functions to analyze cryptographic protocols for secrecy under nonempty equational theories. The witness-functions are safe metrics used to compute security. An analysis with a witness-function consists in making sure that the security of every atomic message does not decrease during its lifecycle in the protocol. The analysis gets more difficult under nonempty equational theories. Indeed, the intruder can take advantage of the algebraic properties of the cryptographic primitives to derive secrets. These properties arise from the use of mathematical functions, such as multiplication, addition, exclusive-or or modular exponentiation in the cryptosystems and the protocols. Here, we show how to use the witness-functions under nonempty equational theories and we run an analysis on the Needham-Schroeder-Lowe protocol under the cipher homomorphism. This analysis reveals that although this protocol is proved secure under the perfect encryption assumption, its security collapses under the homomorphic primitives. We show how the witness-functions help to illustrate an attack scenario on it and we propose an amended version to fix it.

Formal reasoning on authentication in security protocols

In this paper, we are proposing a new formal framework for reasoning on authentication in security protocols based on analytic functions. We give sufficient conditions that, if satisfied, the protocol is declared correct with respect to authentication. We validate our approach on the Yahalom-Lowe protocol. First, we show that it satisfies these few conditions, thus, we conclude that it is correct for authentication.

Considerations regarding security issues impact on systems availability

Control systems behavior can be analyzed taking into account a large number of parameters: performances, reliability, availability, security. Each control system presents various security vulnerabilities that affect in lower or higher measure its functioning. In this paper the authors present a method to assess the impact of security issues on the systems availability. A fuzzy model for estimating the availability of the system based on the security level and achieved availability coefficient (depending on MTBF and MTR) is developed and described. The results of the fuzzy inference system (FIS) are presented in the last section of the paper.

Sidelobe level reduction in linear array pattern synthesis using Taylor-MUSIC algorithm for reliable IEEE 802.11 MIMO applications

The concepts of array processing and smart antenna give a promising solution to the significant increase of data rates in wireless transmission systems. In this paper, we deal with the problem of designing linear antenna arrays for specific radiation properties of MIMO applications based on Direction-Of-Arrival estimation and Taylor beamforming techniques. The objectives of this paper can be summarized as to minimize the maximum sidelobe level (SLL), combined the Taylor method and MUSIC (Multiple Signal Classification) algorithm. The performance of this hybrid optimization determines how well the system is convenient for a reliable wireless communication and interference reduction. This paper will discuss the application of MUSIC algorithm for linear array antenna (4, 8 and 16 antennas) in order to estimate the Direction-Of-Arrival of various angles of elevation and azimuth.

Innovative Fuzzy Approach on Analyzing Industrial Control Systems Security

Industrial control systems are now very important components of the critical infrastructures. The security threats upon industrial control systems endangers the proper functioning of energy production facilities, the power grid, water production and distribution, chemical and petrochemical plants, food production facilities. This chapter presents an overview of potential and registered threats of industrial control systems. A risk assessment on this matter it is of high importance and the chapter has as focus an innovative fuzzy based approach on industrial control systems security. Two fuzzy based models are introduced, one for the attacker profile and one for attack success rate estimation. Finally, an industrial case study is presented with conclusions to proposed models limitations and challenges.

Tracking Security Flaws in Cryptographic Protocols Using Witness-Functions

In this paper, we use witness-function to capture attack scenarios in cryptographic protocols. A witness-function is a protocol-dependent metric that attributes a reliable security level to every atomic message. We use these functions to prove the protocol correctness with respect to secrecy by proving that the security level of every atomic message never decreases throughout all consecutive receiving and sending steps of the protocol. In this paper, we analyze the defective variant of the Otway-Rees protocol and we demonstrate that the use of witness-functions can be a key element in tracing a well-known type flaw that this protocol involves.

A slow read attack using cloud

Cloud computing relies on sharing computing resources rather than having local servers or personal devices to handle applications. Nowadays, cloud computing has become one of the fastest growing fields in information technology. However, several new security issues of cloud computing have emerged due to its service delivery models. In this paper, we discuss the case of distributed denial-of-service (DDoS) attack using Cloud resources. First, we show how such attack using a cloud platform could not be detected by previous techniques. Then we present a tricky solution based on the cloud as well.

Secrecy by witness-functions on increasing protocols

In this paper, we present a new formal method to analyze cryptographic protocols statically for the property of secrecy. It consists in inspecting the level of security of every component in the protocol and making sure that it does not diminish during its life cycle. If yes, it concludes that the protocol keeps its secret inputs. We analyze in this paper an amended version of the Woo-Lam protocol using this new method.