Search

The emergence of blockchain technology and cryptocurrencies opened the possibility for building novel peer-to-peer (P2P) resource allocation and sharing models. However, the trustless nature of these P2P models creates the need for reliable and effective trust and reputation mechanisms to minimize the risk of accessing or interacting with malicious peers. Blockchain technology, which is renowned for ensuring trust in trustless environments, provides us with new mechanisms to overcome the weaknesses of the existing reputation and trust management protocols. This paper proposes BTrust, an innovative decentralized and modular trust management system based on blockchain technology for evaluating trust in large-scale P2P networks. To quantify and assess the trustworthiness of peers and identify malicious peers, BTrust introduces a multi-dimensional trust and reputation model to represent trust and reputation scores in a single value derived from multiple parameters with appropriate weightings. Other contributions of this paper include the combination of recommendation and evidence-based approaches into a single system to provide a reliable and versatile way to compute trust in the network, an optimized trustless bootstrapping process to select trustworthy peers among neighbour peers and an incentive mechanism to encourage truthful feedback. We implement and evaluate the BTrust protocol using simulations and show that BTrust is highly resilient to failures and robust against malicious nodes. [ABSTRACT FROM AUTHOR]

Blockchain technology has gained increasing attention from research and industry over the recent years. It allows implementing in its environment the smart-contracts technology which is used to automate and execute agreements between users. The blockchain is proposed today as a new technical infrastructure for several types of IT applications. This interest is mainly due to its core property that allows two users to perform transactions without going through a Trusted Third Party, while offering a transparent and fully protected data storage. However, a blockchain comes along a number of other intrinsic properties, which may not be suitable or beneficial in all the envisaged application cases. Consequently, we propose in this paper to design a new tool which is "a decision tree" that allows identifying when a blockchain may be the appropriate technical infrastructure for a given IT application, and when another classical system (centralized or distributed peer-to-peer) is more adapted. The proposed decision tree allows also identifying whether or not it is necessary to use the smart-contracts technology. [ABSTRACT FROM AUTHOR]

EMV is the protocol implemented to secure the communication, between a client's payment device and a merchant's payment device, during a contact or an NFC purchase transaction. It represents a set of security messages and rules, exchanged between the different transaction actors, guaranteeing several important security properties, such as authentication, non-repudiation and integrity. Indeed, researchers, in various studies, have analyzed the operation of this protocol in order to verify its safety: unfortunately, they have identified two security vulnerabilities that lead to multiple attacks and dangerous risks threatening both clients and merchants. In this paper, we are firstly interested in presenting a general overview of the EMV protocol and secondly, in proposing a new security solution that enhances the EMV protocol by solving the two dangerous EMV vulnerabilities. We verify the accuracy of our solution by using the Scyther security verification tool. [ABSTRACT FROM AUTHOR]

The next generation of mobile networks, 5G, is expected to support a set of multiple requirements and use cases that will create an improved user experience. 5G will also be able to provide a high level of security by considering a variety of security aspects, such as authentication and access control mechanisms. The current protocol in 4G designed to address security is 4G AKA. It presents some weaknesses and vulnerabilities that negatively affect operators' networks and their subscribers' security. In designing an authentication and access control mechanism for 5G, it is crucial to evaluate both 4G AKA's weaknesses and the new requirements of 5G. In this paper, we survey the vulnerabilities of the 4G AKA protocol, as well as the current 5G architectural answers brought by the 3GPP. [ABSTRACT FROM AUTHOR]

The Internet of Things operates in a personal-data-rich sector, which makes security and privacy an increasing concern for consumers. Access control is thus a vital issue to ensure trust in the IoT. Several access control models are today available, each of them coming with various features, making them more or less suitable for the IoT. This article provides a comprehensive survey of these different models, focused both on access control models (e.g., DAC, MAC, RBAC, ABAC) and on access control architectures and protocols (e.g., SAML and XACML, OAuth 2.0, ACE, UMA, LMW2M, AllJoyn). The suitability of each model or framework for IoT is discussed. In conclusion, we provide future directions for research on access control for the IoT: scalability, heterogeneity, openness and flexibility, identity of objects, personal data handling, dynamic access control policies, and usable security. [ABSTRACT FROM AUTHOR]

With the adoption of a service-oriented paradigm on the Web, many software services are likely to fulfil similar functional needs for end-users. We propose to aggregate functionally equivalent software services within one single virtual service, that is, to associate a functionality, a graphical user interface (GUI), and a set of selection rules. When an end user invokes such a virtual service through its GUI to answer his/her functional need, the software service that best responds to the end-user's selection policy is selected and executed and the result is then rendered to the end-user through the GUI of the virtual service. A key innovation in this paper is the flexibility of our proposed service selection policy. First, each selection policy can refer to heterogeneous parameters (e.g., service price, end-user location, and QoS). Second, additional parameters can be added to an existing or new policy with little investment. Third, the end users themselves define a selection policy to apply during the selection process, thanks to the GUI element added as part of the virtual service design. This approach was validated though the design, implementation, and testing of an end-to-end architecture, including the implementation of several virtual services and utilizing several software services available today on the Web. [ABSTRACT FROM AUTHOR]

Users’ needs are the driver of the next generation of telecom services. Founding the services on users’ needs requires that various services cooperate together to meet specific needs. As a consequence, services should no more be developed as “silo” but with composable service enablers. This enabler paradigm raises the issues of the identification of the enablers and of the consistency of a service composed from various enablers. These issues must be addressed by considering the service from the user point of view: what is the added value for the user and through which perceived steps is this added value provided? Such service business processes are then a key tool to identify enablers and to ensure the coherence of composed service. [ABSTRACT FROM AUTHOR]